Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.datemas.de!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: "Christoph M. Becker" <cmbecker69@arcor.de>
Newsgroups: comp.lang.javascript
Subject: Re: Removing scripts
Date: Sun, 11 Jan 2015 12:56:43 +0100
Organization: solani.org
Lines: 27
Message-ID: <m8todg$hvs$1@solani.org>
References: <100120151843135093%timstreater@greenbee.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Trace: solani.org 1420977392 18428 eJwFwYEBwCAIA7CXVqFAz5ko/59gQgtEpwfDOZyNs+wgtFnd4Bz90CXrujlsZOXfUmUrbfwBFaAQWw== (11 Jan 2015 11:56:32 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Sun, 11 Jan 2015 11:56:32 +0000 (UTC)
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0
X-User-ID: eJwFwYEBgDAIA7CXRGjBc0aF/09YAqdRGQQDixXwe3x7TO1iR2KeHGvNSyRQWTlE11lN8wIiiRF0
In-Reply-To: <100120151843135093%timstreater@greenbee.net>
Cancel-Lock: sha1:NtbCgQZeRECGlPjSEN8V5ScwdrE=
X-NNTP-Posting-Host: eJwFwQkBwDAIBDBLg3u62YGCfwlLBIf70DK12st66mWXye5aIVIhWE3kGVcayaE+R879ARU9EGY=
Xref: csiph.com comp.lang.javascript:26540

Tim Streater wrote:

> I have some untrusted HTML, so I want to de-activate any <scripts> it
> contains before shoving it into an iframe. Is there any reason not to
> do the following?
> 
> newdoc  = new DOMParser().parseFromString (untrustedHTML, 'text/html');
> scripts = newdoc.querySelectorAll ('script');
> num     = scripts.length;
> 
> for  (i=0;  i<num;  i++)
>     {
>     newdoc.removeChild (scripts[i]);
>     }
> 
> iframePtr.open ();
> iframePtr.write (new XMLSerializer().serializeToString (newdoc));
> iframePtr.close ();

Have you considered event handler attributes?  Have you considered to
set an appropriate sandbox attribute[1] on the iframe, instead.

[1] <http://www.w3.org/TR/html5/embedded-content-0.html#attr-iframe-sandbox>

-- 
Christoph M. Becker