On Fri, Nov 4, 2011 at 2:54 PM, João Eiras <jo...@opera.com> wrote: > * stripScripts is a boolean that tells the parser to strip unsafe content > like scripts, event listeners and embeds/objects which would be handled by a > 3rd party plugin according to user agent policy.
"According to user agent policy" is a huge interoperability problem. (IIRC, Collin Jackson listed IE's toStaticHTML as an example of a bad security feature for this reason in his USENIX talk.) If we expose an HTML sanitizer to Web content as a DOM API, we should have a clear normative spec that says what exactly the sanitizer does. Stuff to debate includes what to do about Content MathML, what to do about <object> elements that appear to reference SVG and what to do about <embed> elements that bear Microdata attributes. -- Henri Sivonen hsivo...@iki.fi http://hsivonen.iki.fi/
