You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Yeah - I know the title might sound as if I'm crazy, but it's a serious question. I'd like to either:
Load HTML to DOM, without executing any scripts and then call a script on loaded DOM.
or
Be able to execute script on a page, but if that script uses DOMParser, then scripts in HTML parsed by it should not be executed.
My specific case: I'm trying to evaluate if it is possible to run DOMPurify server side, so that my sanitization on server side is as close as possiblt to the client side. Before I start conversion of JS to C#, I decided to check if DOMPurify will work "out of the box" and what its performace will be. After working around of some issues (e.g. #101) it does work for simple cases, but I encountered issues sanitizing HTML with script tags. I'm aware that a lot more can backfire, but hey - why not try! :)
I'm sure I can workaround this problem as well, but again - maybe I miss some obvious solution. I saw in code, that if fragment is processed, then scripts execution is skipped. I'm not sure if that is what I want, but maybe there's another way...
Sounds interesting - from the top of my head: no. But I think it would be viable to introduce a callback that would (if set) allow you to decide if you want to run a script or not. If no callback is given it will default to always return true, i.e., always run the script.
Thanks for the reply! As a follow-up - using simple callback works as expected, but unfortunately I stumbled on a few other problems, which I will report as separate issues a bit later. Before reporting, I'll ask some things on gitter, because maybe I'm just doing something wrong.
Yeah - I know the title might sound as if I'm crazy, but it's a serious question. I'd like to either:
or
My specific case: I'm trying to evaluate if it is possible to run DOMPurify server side, so that my sanitization on server side is as close as possiblt to the client side. Before I start conversion of JS to C#, I decided to check if DOMPurify will work "out of the box" and what its performace will be. After working around of some issues (e.g. #101) it does work for simple cases, but I encountered issues sanitizing HTML with script tags. I'm aware that a lot more can backfire, but hey - why not try! :)
I'm sure I can workaround this problem as well, but again - maybe I miss some obvious solution. I saw in code, that if fragment is processed, then scripts execution is skipped. I'm not sure if that is what I want, but maybe there's another way...
Versions:
AngleSharp & AngleSharp.JS: master
Jint: 4.2.1
The text was updated successfully, but these errors were encountered: