3 ms·
Well in HTML you can use a sandboxed iframe (or <webview> in technologies that have it), but it's not cheap.
by nraynaud 13y ago
Well in HTML you can use a sandboxed iframe (or <webview> in technologies that have it), but it's not cheap.
- tokenizerrr 13y agoI just remembered visiting a website that used iframe's with script tags disabled for users their signatures. It was a pretty interesting approach.
- ceejayoz 13y agoI just hope they used a proper lib like Purifier to do it, or someone's going to have fun with `onmouseover`.
- nraynaud 13y agoI think that when it's sandboxed with the proper attributes, you can't do anything appart from trashing the content of the frame.
- ceejayoz 13y agoI had no clue that was so widely supported. No IE8/9 but virtually everything else. Neato! http://caniuse.com/#feat=iframe-sandbox http://caniuse.com/#feat=iframe-sandbox