3 ms·
There are a lot JS frameworks nowadays where there is no HTML, really, just a little something to trigger the script. Everything else is JavaScript generated an
by lnanek2 14y ago
There are a lot JS frameworks nowadays where there is no HTML, really, just a little something to trigger the script. Everything else is JavaScript generated and inserted HTML. I don't see how this could handle something like a new anchor being added with an javascript: href, or even just the eval command, for example. Doesn't seem smart to break JS compatibility like this if the language wants to win any mind share.
- sethladd 14y ago[disclaimer, I work on the Dart team] While I do believe our Dart/JavaScript interop story will continue to be refined, I do want to point out that the days of javascript: URLs and eval are nearly over. The Web is getting a stronger security model through CSP [1] (content security policy). New restrictions put in place by CSP include turning off eval, new Function, inline JavaScript, and more. This is a very good thing, because it reduces the attack vectors for XSS and more. [1] http://www.html5rocks.com/en/tutorials/security/content-security-policy/ http://www.html5rocks.com/en/tutorials/security/content-secu...