Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposal on how to deal with <script>-blocks when appending to the DOM #76

Open
Kruemelmann opened this issue Nov 26, 2023 · 0 comments

Comments

@Kruemelmann
Copy link

I hope my post is in the right place, if not I would like to apologise.

The problem

I have a suggestion about DOM parsing which requires a specification change or extension.
The problem has already been mentioned here in two issues, one Issue 6 and the other Issue 19.
In short, in both cases the question arises as to how script blocks should be handled when they are appended to the DOM. My proposal also relates primarily to script blocks.
W3c Spec innerHTML under this link it is described that script blocks appended with .innerHTML are not executed. However, there may be cases in which it makes sense to execute the scripts.

Proposed solution

By assigning a value to .innerHTML, executing the script blocks would probably be too great a security risk.

However, an additional parameter could be added to the insertAdjacentHTML method with which the scripts can be executed.

For example:

.insertAdjacentHTML(position, text, script_exec)

Implementation idea

...
function insertAdjacentHTML(position, text, script_exec = false) {
...

By default, script_exec is false so that nothing changes for the caller of the function. (i.e. even existing ones continue to work without a negative effect)

For example:

...
.insertAdjacentHTML("beforebegin" , htmlstr)
...

However, if the caller now not only wants to add the <script>-blocks but also execute them, he must explicitly set the parameter to true.

For example:

...
.insertAdjacentHTML("beforebegin", htmlstr, true)
...

If my idea is in the wrong place here, I would like to apologise again and ask where I could best post it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant