[whatwg] Javascript: URLs as element attributes

[Philip Jägenstedt]

On Thu, 02 Dec 2010 23:56:33 +0100, Boris Zbarsky <bzbarsky at mit.edu> wrote:

> On 12/2/10 2:31 PM, Daniel Veditz wrote:
>> On 12/1/10 7:29 AM, Boris Zbarsky wrote:
>>> On 12/1/10 3:49 AM, Philip Jägenstedt wrote:
>>> I dunno about solid, but the obvious things you can do with
>>> javascript: that you can't do as easily with data: are things
>>> that are dynamic. That said, in a sandbox the only things that
>>> are available as obvious sources of dynamism are |new Date| and
>>> |Math.random|.  So achieving solidity might take some work.  ;)
>>
>> What dynamism does a javascript: url give you that can't be achieved
>> by running an in-page script to generate data: urls?
>
> None, except for the fact that the in-page script would have to find the  
> right places to stick those data: URIs, which might be impossible.  For  
> example, if I load a cross-site stylesheet, and it wants to have a  
> dynamically-generated image like so |content: url("javascript:...")|  
> then I couldn't handle that via script from my page, because I can't  
> touch the OM of that cross-site sheet.

It would be quite straight-forward to use a cross-site <script> instead,  
one that generates the data: URL and then inserts a stylesheet. It also  
has the benefit of making it clear to the including side that scripting is  
needed for it to work.

(Realistically though, just generating the images once on the server-side  
as a JPEG/PNG is a more likely solution.)

-- 
Philip Jägenstedt
Core Developer
Opera Software