<div dir="ltr">On Tue, Jul 22, 2008 at 3:22 PM, Frode Børli <<a href="mailto:frode@seria.no" target="_blank">frode@seria.no</a>> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
The server must escape all user generated content by replacing < with<br>
< etc. This is perfectly secure for all existing browsers. The<br>
sandbox instructs the browser to unescape. Completely fail safe for<br>
all.</blockquote><div><br>Thanks for the clarification. As mentioned previously by other poster, I think this could work iff UAs can be passed a set of safe tags, attributes, and whatnot (i.e., a whitelist), defaulting to the empty set if no such set is specified. UAs can then unescape permitted elements, filter out disallowed attributes, and then handle the code as normal.<br>
<br>Perhaps the whitelist could be specified in a format akin to CSS. For example:<br><span sandbox=1 whitelist="elements: a, em; attributes: href, lang, rel; style-properties: color, font-weight"> ... </span><br>
For larger or often-used whitelists, a URL could be specified as in: <span sandbox=1 whitelist="<a href="http://example.com/whitelist">http://example.com/whitelist</a>">, which would permit the whitelist to be cached or used in multiple places in a document.<br>
<br>One design flaw of this whitelist format that comes to mind is that all the specified attributes are allowed for all the specified elements. For example, it is not possible to allow the "lang" attribute for only the "a" element but not an "em" element in the same sandbox; i.e. the whitelist "elements: a, em; attributes: href, lang" permits both <a lang="en"> and <em lang="en">. On a side note, although the whitelist would permit <em href="">, it would be treated as invalid HTML of course.<br>
<br>Comments?<br><br>- James<br>
</div></div></div>