Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #13694 > unrolled thread

Deleting <script> elements

Back to article view | Back to comp.lang.javascript

Contents

  Deleting <script> elements Tim Streater <timstreater@greenbee.net> - 2012-04-29 19:34 +0100
    Re: Deleting <script> elements "Evertjan." <exjxw.hannivoort@interxnl.net> - 2012-04-29 19:07 +0000
      Re: Deleting <script> elements Tim Streater <timstreater@greenbee.net> - 2012-04-29 20:53 +0100
    Re: Deleting <script> elements Martin Honnen <mahotrash@yahoo.de> - 2012-04-30 11:31 +0200
      Re: Deleting <script> elements Martin Honnen <mahotrash@yahoo.de> - 2012-04-30 11:33 +0200
      Re: Deleting <script> elements Tim Streater <timstreater@greenbee.net> - 2012-04-30 12:33 +0100
        Re: Deleting <script> elements Martin Honnen <mahotrash@yahoo.de> - 2012-04-30 13:55 +0200
          Re: Deleting <script> elements Tim Streater <timstreater@greenbee.net> - 2012-04-30 13:11 +0100
          Re: Deleting <script> elements Stefan Weiss <krewecherl@gmail.com> - 2012-04-30 14:47 +0200
            Re: Deleting <script> elements Martin Honnen <mahotrash@yahoo.de> - 2012-04-30 16:25 +0200
    Re: Deleting <script> elements Denis McMahon <denismfmcmahon@gmail.com> - 2012-04-30 21:38 +0000
      Re: Deleting <script> elements Tim Streater <timstreater@greenbee.net> - 2012-04-30 22:53 +0100
      Re: Deleting <script> elements Dr J R Stockton <reply1218@merlyn.demon.co.uk.not.invalid> - 2012-05-01 19:57 +0100
    Re: Deleting <script> elements Dr J R Stockton <reply1218@merlyn.demon.co.uk.not.invalid> - 2012-04-30 19:28 +0100

#13694 — Deleting <script> elements

Apart from the obvious potential loss of functionality, is there any 
reason I shouldn't delete all <script> elements from a page being 
displayed in an iframe by doing something along these lines:

ptr   = window.frames["Frame1"].document;
myarr = ptr.getElementsByTagName ('script');

for  (i=0; i<myarr.length; i++)
     {
     ptr.removeChild (myarr[i]);
     }

I'd be planning to do this immediately after doing ptr.write 
(html_string), so any scripts in html_string wouldn't have had a chance 
to run, anyway.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [next] | [standalone]

#13695

Tim Streater wrote on 29 apr 2012 in comp.lang.javascript:

> Apart from the obvious potential loss of functionality, is there any 
> reason I shouldn't delete all <script> elements from a page being 
> displayed in an iframe by doing something along these lines:
> 
> ptr   = window.frames["Frame1"].document;
> myarr = ptr.getElementsByTagName ('script');
> 
> for  (i=0; i<myarr.length; i++)
>      {
>      ptr.removeChild (myarr[i]);
>      }
> 
> I'd be planning to do this immediately after doing ptr.write 
> (html_string), so any scripts in html_string wouldn't have had a chance 
> to run, anyway.

Why not remove them immediately before as in:

html_string = html_string.replace(/<script.*?(<\/script>)<\/script>/gim,'')




-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#13696

In article <XnsA044D6F3F8050eejj99@194.109.133.133>,
 "Evertjan." <exjxw.hannivoort@interxnl.net> wrote:

> Tim Streater wrote on 29 apr 2012 in comp.lang.javascript:
> 
> > Apart from the obvious potential loss of functionality, is there any 
> > reason I shouldn't delete all <script> elements from a page being 
> > displayed in an iframe by doing something along these lines:
> > 
> > ptr   = window.frames["Frame1"].document;
> > myarr = ptr.getElementsByTagName ('script');
> > 
> > for  (i=0; i<myarr.length; i++)
> >      {
> >      ptr.removeChild (myarr[i]);
> >      }
> > 
> > I'd be planning to do this immediately after doing ptr.write 
> > (html_string), so any scripts in html_string wouldn't have had a chance 
> > to run, anyway.
> 
> Why not remove them immediately before as in:
> 
> html_string = html_string.replace(/<script.*?(<\/script>)<\/script>/gim,'')

Same reason as for the target business: this is someone else's html that 
may be malformed in any number of ways. As with the target issue, I 
realised that what needs to be adjusted is what ends up in the DOM, not 
what's in the html string.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]

#13702

Tim Streater wrote:
> Apart from the obvious potential loss of functionality, is there any
> reason I shouldn't delete all <script> elements from a page being
> displayed in an iframe by doing something along these lines:
>
> ptr = window.frames["Frame1"].document;
> myarr = ptr.getElementsByTagName ('script');
>
> for (i=0; i<myarr.length; i++)
> {
> ptr.removeChild (myarr[i]);
> }

DOM collection are "live" collections so manipulating items in a 
collection like removing an item from the document tree immediately 
results into a change in the collection.
That way your current code would remove the originally first 'script' 
element with index 0, then the collection changes and with 'i' being 1 
you would remove the originally third 'script' element and so on.
Due to collections being live you are therefore better off to work from 
the end e.g.
   for (var i = myarr.length - 1; i >= 0; i--) {
     myarr[i].parentNode.removeChild(myarr[i]);
   }
or to use
   while (myarr.length > 0) {
     myarr[0].parentNode.removeChild(myarr[i]);
   }
That is the technically issue for the writing code that removes the 
'script' elements from the DOM tree.

I am not aware however of any browser unloading script code when you 
remove a 'script' element or 'script' element removal preventing code 
execution.



-- 

	Martin Honnen --- MVP Data Platform Development
	http://msmvps.com/blogs/martin_honnen/

[toc] | [prev] | [next] | [standalone]

#13703

Martin Honnen wrote:

> while (myarr.length > 0) {
> myarr[0].parentNode.removeChild(myarr[i]);

Should be
   myarr[0].parentNode.removeChild(myarr[0]);
of course.



-- 

	Martin Honnen --- MVP Data Platform Development
	http://msmvps.com/blogs/martin_honnen/

[toc] | [prev] | [next] | [standalone]

#13710

In article <4f9e5c06$0$9515$9b4e6d93@newsspool1.arcor-online.net>,
 Martin Honnen <mahotrash@yahoo.de> wrote:

> Tim Streater wrote:
> > Apart from the obvious potential loss of functionality, is there any
> > reason I shouldn't delete all <script> elements from a page being
> > displayed in an iframe by doing something along these lines:
> >
> > ptr = window.frames["Frame1"].document;
> > myarr = ptr.getElementsByTagName ('script');
> >
> > for (i=0; i<myarr.length; i++)
> > {
> > ptr.removeChild (myarr[i]);
> > }
> 
> DOM collection are "live" collections so manipulating items in a 
> collection like removing an item from the document tree immediately 
> results into a change in the collection.
> That way your current code would remove the originally first 'script' 
> element with index 0, then the collection changes and with 'i' being 1 
> you would remove the originally third 'script' element and so on.

Well I only said "along these lines". It would be trivial to add:

num = myarr.length;

and use num as the upper limit in the 'for'.

> Due to collections being live you are therefore better off to work from 
> the end e.g.
>    for (var i = myarr.length - 1; i >= 0; i--) {
>      myarr[i].parentNode.removeChild(myarr[i]);
>    }
> or to use
>    while (myarr.length > 0) {
>      myarr[0].parentNode.removeChild(myarr[i]);
>    }
> That is the technically issue for the writing code that removes the 
> 'script' elements from the DOM tree.
> 
> I am not aware however of any browser unloading script code when you 
> remove a 'script' element or 'script' element removal preventing code 
> execution.

Well this is an important point. You're saying then that by the time I'm 
trying to remove script elements, the browser already has the code 
parsed and ready for execution, separate from the DOM?

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]

#13711

Tim Streater wrote:
> In article <4f9e5c06$0$9515$9b4e6d93@newsspool1.arcor-online.net>,
> Martin Honnen <mahotrash@yahoo.de> wrote:
>
>> Tim Streater wrote:
>> > Apart from the obvious potential loss of functionality, is there any
>> > reason I shouldn't delete all <script> elements from a page being
>> > displayed in an iframe by doing something along these lines:
>> >
>> > ptr = window.frames["Frame1"].document;
>> > myarr = ptr.getElementsByTagName ('script');
>> >
>> > for (i=0; i<myarr.length; i++)
>> > {
>> > ptr.removeChild (myarr[i]);
>> > }
>>
>> DOM collection are "live" collections so manipulating items in a
>> collection like removing an item from the document tree immediately
>> results into a change in the collection.
>> That way your current code would remove the originally first 'script'
>> element with index 0, then the collection changes and with 'i' being 1
>> you would remove the originally third 'script' element and so on.
>
> Well I only said "along these lines". It would be trivial to add:
>
> num = myarr.length;
>
> and use num as the upper limit in the 'for'.

That doesn't suffice, even if you store the initial length before 
starting to remove items, the collection changes every time you remove 
an item so you will only remove every second item and get an error later 
on when loop index variable is greater than the number of remaining 
items: http://jsfiddle.net/jbKZh/
So you will need to remove down from the last element 
(http://jsfiddle.net/BAb49/1/) or you will need to remove the first one 
until there is no further element (http://jsfiddle.net/aQYLs/1/).


>> I am not aware however of any browser unloading script code when you
>> remove a 'script' element or 'script' element removal preventing code
>> execution.
>
> Well this is an important point. You're saying then that by the time I'm
> trying to remove script elements, the browser already has the code
> parsed and ready for execution, separate from the DOM?


My understanding indeed is that a script element you can find in the DOM 
tree of the document has been parsed and its code has been evaluated. 
The use of the IE 'defer' attribute and/or the HTML5 'async' attribute 
however may change that.


-- 

	Martin Honnen --- MVP Data Platform Development
	http://msmvps.com/blogs/martin_honnen/

[toc] | [prev] | [next] | [standalone]

#13713

In article <4f9e7d98$0$9507$9b4e6d93@newsspool1.arcor-online.net>,
 Martin Honnen <mahotrash@yahoo.de> wrote:

> Tim Streater wrote:
> > In article <4f9e5c06$0$9515$9b4e6d93@newsspool1.arcor-online.net>,
> > Martin Honnen <mahotrash@yahoo.de> wrote:
> >
> >> Tim Streater wrote:
> >> > Apart from the obvious potential loss of functionality, is there any
> >> > reason I shouldn't delete all <script> elements from a page being
> >> > displayed in an iframe by doing something along these lines:
> >> >
> >> > ptr = window.frames["Frame1"].document;
> >> > myarr = ptr.getElementsByTagName ('script');
> >> >
> >> > for (i=0; i<myarr.length; i++)
> >> > {
> >> > ptr.removeChild (myarr[i]);
> >> > }
> >>
> >> DOM collection are "live" collections so manipulating items in a
> >> collection like removing an item from the document tree immediately
> >> results into a change in the collection.
> >> That way your current code would remove the originally first 'script'
> >> element with index 0, then the collection changes and with 'i' being 1
> >> you would remove the originally third 'script' element and so on.
> >
> > Well I only said "along these lines". It would be trivial to add:
> >
> > num = myarr.length;
> >
> > and use num as the upper limit in the 'for'.
> 
> That doesn't suffice, even if you store the initial length before 
> starting to remove items, the collection changes every time you remove 
> an item so you will only remove every second item and get an error later 
> on when loop index variable is greater than the number of remaining 
> items: http://jsfiddle.net/jbKZh/
> So you will need to remove down from the last element 
> (http://jsfiddle.net/BAb49/1/) or you will need to remove the first one 
> until there is no further element (http://jsfiddle.net/aQYLs/1/).

:-)

Yes, you're right. I did all that in too much of a hurry.

> >> I am not aware however of any browser unloading script code when you
> >> remove a 'script' element or 'script' element removal preventing code
> >> execution.
> >
> > Well this is an important point. You're saying then that by the time I'm
> > trying to remove script elements, the browser already has the code
> > parsed and ready for execution, separate from the DOM?
> 
> My understanding indeed is that a script element you can find in the DOM 
> tree of the document has been parsed and its code has been evaluated. 
> The use of the IE 'defer' attribute and/or the HTML5 'async' attribute 
> however may change that.

OK - thanks for that.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]

#13714

On 2012-04-30 13:55, Martin Honnen wrote:
> My understanding indeed is that a script element you can find in the DOM 
> tree of the document has been parsed and its code has been evaluated.

There is at least one way to add script elements, or HTML containing
script elements, without having them evaluated:

<div id="container">...</div>

<script>
    document.getElementById("container").innerHTML =
       '<script id="sc">alert(123)<\/script>';
    if (document.getElementById("sc")) {
        alert("in the DOM, but not evaluated");
    }
</script>

Only the second alert() will be displayed.


- stefan

[toc] | [prev] | [next] | [standalone]

#13716

Stefan Weiss wrote:
> On 2012-04-30 13:55, Martin Honnen wrote:
>> My understanding indeed is that a script element you can find in the DOM
>> tree of the document has been parsed and its code has been evaluated.
>
> There is at least one way to add script elements, or HTML containing
> script elements, without having them evaluated:
>
> <div id="container">...</div>
>
> <script>
>      document.getElementById("container").innerHTML =
>         '<script id="sc">alert(123)<\/script>';
>      if (document.getElementById("sc")) {
>          alert("in the DOM, but not evaluated");
>      }
> </script>
>
> Only the second alert() will be displayed.

Yes, right, I did not think about script added that way. I think the 
HTML5 doc 
http://www.w3.org/TR/html5/the-script-element.html#parser-inserted takes 
considerable effort to specify what has to happen with different kinds 
of creation of script elements but I am not familiar with details.


-- 

	Martin Honnen --- MVP Data Platform Development
	http://msmvps.com/blogs/martin_honnen/

[toc] | [prev] | [next] | [standalone]

#13719

On Sun, 29 Apr 2012 19:34:13 +0100, Tim Streater wrote:

> Apart from the obvious potential loss of functionality, is there any
> reason I shouldn't delete all <script> elements from a page being
> displayed in an iframe by doing something along these lines:

This might be a dumb question, but I thought that you could only 
manipulate the content of an iframe if it was from the same host as the 
containing page?

In which case, would it not be easier to do the de-scripting on the 
server before serving the iframe content?

Rgds

Denis McMahon

[toc] | [prev] | [next] | [standalone]

#13720

In article <4f9f063a$0$2766$a8266bb1@newsreader.readnews.com>,
 Denis McMahon <denismfmcmahon@gmail.com> wrote:

> On Sun, 29 Apr 2012 19:34:13 +0100, Tim Streater wrote:
> 
> > Apart from the obvious potential loss of functionality, is there any
> > reason I shouldn't delete all <script> elements from a page being
> > displayed in an iframe by doing something along these lines:
> 
> This might be a dumb question, but I thought that you could only 
> manipulate the content of an iframe if it was from the same host as the 
> containing page?
> 
> In which case, would it not be easier to do the de-scripting on the 
> server before serving the iframe content?

Here's the deal. I receive emails, and put them in an SQLite db. Later, 
I want to see the email, so the browser uses ajax to retrieve the html, 
and shoves it in the iframe. This all takes place on one machine: server 
is localhost.

At present I do indeed strip the <scripts> on the fly in PHP before 
sending the results back to the browser. But this is problematic in that 
the html can be malformed in any number of ways and in general, it's 
probably better to let the browser make sense of it. That's what it's 
paid to do, after all.

I used to use PHP also to fix up empty hrefs and ensure that links had a 
target="_blank", too, but then realised that again, it's a lot more 
reliable to let the browser populate the DOM and then deal with those 
after the fact. That turns out to be a lot simpler and means I don't 
have to do some nasty parsing or try to use an incomprehensible regexp 
on the PHP side.

However, it looks like I can't eliminate the <script>s after the fact - 
or at least I could but it would be too late. I do however have some 
hopes that the html5 iframe sandbox might solve the issue for me.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]

#13752

In comp.lang.javascript message <4f9f063a$0$2766$a8266bb1@newsreader.rea
dnews.com>, Mon, 30 Apr 2012 21:38:02, Denis McMahon
<denismfmcmahon@gmail.com> posted:

>
>This might be a dumb question, but I thought that you could only
>manipulate the content of an iframe if it was from the same host as the
>containing page?

And not always then, if the browser is Chrome after version 4 and the
browser is reading directly from the local disc.

-- 
 (c) John Stockton, nr London, UK. ?@merlyn.demon.co.uk  Turnpike v6.05  MIME.
  Web  <http://www.merlyn.demon.co.uk/> - FAQqish topics, acronyms and links;
  Astro stuff via astron-1.htm, gravity0.htm ; quotings.htm, pascal.htm, etc.
 No Encoding. Quotes before replies. Snip well. Write clearly. Don't Mail News.

[toc] | [prev] | [next] | [standalone]

#13721

In comp.lang.javascript message <timstreater-FB7160.19341329042012@news.
individual.net>, Sun, 29 Apr 2012 19:34:13, Tim Streater
<timstreater@greenbee.net> posted:

>Apart from the obvious potential loss of functionality, is there any
>reason I shouldn't delete all <script> elements from a page being
>displayed in an iframe by doing something along these lines:
>
>ptr   = window.frames["Frame1"].document;
>myarr = ptr.getElementsByTagName ('script');
>
>for  (i=0; i<myarr.length; i++)
>    {
>    ptr.removeChild (myarr[i]);
>    }
>
>I'd be planning to do this immediately after doing ptr.write
>(html_string), so any scripts in html_string wouldn't have had a chance
>to run, anyway.


If MyArr is not a plain array but a more dynamic thing (I forget the
proper term), then removing the first element could cause all the later
ones to renumber, and you would fall off the end when you thought you
were only half-way.

I'd use a while loop counting down to zero, and remove from the end
rather than the beginning, by habit.  That is a harmless change, I
think; it may also be necessary, and is probably a good habit.

It's not clear to me that you want to remove a *child*, though.  An
unsubtle alternative would be to loop through the scripts setting their
innerHTMLs to "", if they have such; or similar.

Test in all possible browsers.

-- 
 (c) John Stockton, Surrey, UK.  ?@merlyn.demon.co.uk   Turnpike v6.05   MIME.
   Web  <http://www.merlyn.demon.co.uk/> - FAQish topics, acronyms, & links.
 Proper <= 4-line sig. separator as above, a line exactly "-- " (SonOfRFC1036)
 Do not Mail News to me. Before a reply, quote with ">" or "> " (SonOfRFC1036)

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web