Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.datemas.de!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: "Christoph M. Becker" <cmbecker69@arcor.de>
Newsgroups: comp.lang.javascript
Subject: Re: Removing scripts
Date: Sun, 11 Jan 2015 14:47:03 +0100
Organization: solani.org
Lines: 29
Message-ID: <m8tusc$amb$1@solani.org>
References: <100120151843135093%timstreater@greenbee.net> <m8todg$hvs$1@solani.org> <15618724.3DthdCSHB2@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Trace: solani.org 1420984012 10955 eJwFwYEBgDAIA7CXQFuw5wwY/59gwjc8OhEMcLmPCVmu5vEzGhEmC9ptRyl3sOzSV+K9nT8NtREV (11 Jan 2015 13:46:52 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Sun, 11 Jan 2015 13:46:52 +0000 (UTC)
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0
X-User-ID: eJwNxsEBwCAIA8CVmgJB1wHM/iPovS6MYKcz6KFQk1VeqxIDD1Nr0hb1ZtxokHvEA5/S/10nDRFs
In-Reply-To: <15618724.3DthdCSHB2@PointedEars.de>
Cancel-Lock: sha1:fit3QlainM9eoSFywSS1g9cvsNs=
X-NNTP-Posting-Host: eJwFwYkBwCAIBLCVhHvAcVpb9h/BRHD4FC1ToyEVOw2MshU5i8zqAiq+mB+z1s6QrTrP2xfkTw9V
Xref: csiph.com comp.lang.javascript:26542

Thomas 'PointedEars' Lahn wrote:

> Christoph M. Becker wrote:
> 
>> Tim Streater wrote:
>>> I have some untrusted HTML, so I want to de-activate any <scripts> it
>>> contains before shoving it into an iframe. Is there any reason not to
>>> do the following?
>>> […]
>>> iframePtr.open ();
>>> iframePtr.write (new XMLSerializer().serializeToString (newdoc));
>>> iframePtr.close ();
>>
>> Have you considered event handler attributes?
> 
> Pardon?

The given script[1] only caters for script elements.  One reason not to
use it would be that event handlers on elements could contain malicious
script code, which would pass this "clean up".

> In general, filtering needs to be done server-side,

ACK.  However, a black listing approach is likely to be insufficient anyway.

[1] <news:100120151843135093%timstreater@greenbee.net>

-- 
Christoph M. Becker