[whatwg] innerStaticHTML

[João Eiras]

> PROPOSAL
>
> In addition to innerHTML, DOM elements should expose an
> innerStaticHTML property.  When set, innerStaticHTML should behave the
> same as innerHTML except that scripts should not execute (even in
> event handlers) and plug-ins should not be created.
>

As part of a browser implementation team I can clearly say that the cases where scripts should, or should not run are very hard to implement in a cross browser compatible way. Marking those scripts or plugins are non-executable would make everything much more complex and bug prone. Also, it would be impossible to do that for a onevent attribute without all sorts of problems.
The suggestion of marking content as non-executable doesn't solve anything, because after setting innerStaticHTML another script might serialize a piece of the affected DOM to string and back to a tree, and the code could then execute, which would not be wanted.

The only viable solution, from my point of view, would be for the UA to parse the string, and remove all untrusted content from the result tree before appending to the document.
That would mean removing all onevent attributes, all scripts elements, all plugins, etc. Basically, letting the UA implement all the filtering.



-- 

João Eiras
Core Developer, Opera Software ASA, http://www.opera.com/