2 ms·
Those are issues with JavaScript, not HTML. Wouldn't filtering out iframes pretty much keep us in the clear?
by digging 3y ago
Those are issues with JavaScript, not HTML. Wouldn't filtering out iframes pretty much keep us in the clear?
- layer8 3y agoThe parent wanted interactive 3D plots, which means JavaScript embedded in or linked from the HTML. Then there‘s stuff like JavaScript embedded in SVG.
- CaptainOfCoit 3y ago> Those are issues with JavaScript, not HTML What about various HTML tags that remote load resources? From script, link, to things like img or CSS `background-image` attribute, added in a `style` attribute. There is a bunch of ways to do remote requests even without HTML.
- quickthrower2 3y agoThe same problem exists in HN comments. This comment gets converted to html. But it is fine!
- fdupress 3y ago"gets converted to" and "gets rendered as uploaded by the user" are two different things. There are no issues with arXiv generating the HTML and sending that over: they control the generation process, and users who visit arXiv already trust it to not be malicious. The issue is with letting the user upload their own and having it sent on to other users as is.