3 ms·
Forget (b). I get that it may not be perfect. Why do you think (a) wouldn't work? It is as simple as disabling JS on the HTML pages. That works on all browsers
by chime 16y ago
Forget (b). I get that it may not be perfect. Why do you think (a) wouldn't work? It is as simple as disabling JS on the HTML pages. That works on all browsers already. Let's keep that + enable JS from .js files. I understand it is more complex than I'm making it out to be but isn't that better than XSS error on the world's largest sites?
- sounddust 16y agoThe implementation of a) would be extremely complex from both a web developer and browser development viewpoint. From the web developer perspective: It's very hard to use JS without putting at least some javascript in the HTML. Loading js files is not very useful if there's no means to actually activate any of the functionality of those files. In order for your idea to work, you'd have to completely strip all HTML of anything that can reference or activate javascript: not just mouseover, but also href="javascript:xxxx()" as well. That means that the only way you could actually use javascript on a page would be to create a function that would be loaded by body_onload to add event listeners and other attributes through DOM manipulation. It would make web development so convoluted that I doubt that you'd succeed in convincing w3c or anyone else to adopt it. I think the right approach has to maintain the workflow and functionality of web development. tptacek posted an idea in the other thread that sounds like it would reduce the number of attack vectors without causing too much difficulty to the developer: include a nonce in the header and require script tags to include that nonce.