Greenheart
commented
3 years ago var inputHTML = `<!DOCTYPE html>
<html>
<head>
<title>hello from parsed code</title>
</head>
<body>
<script>
localStorage.hello = 'hello there!'
console.log(localStorage.hello)
</script>
</body>
</html>`
var parser = new DOMParser();
var parsedDocument = parser.parseFromString(inputHTML, 'text/html');
// set the current page's <html> contents to the newly parsed <html> content
document.getElementsByTagName('html')[0].innerHTML = parsedDocument.getElementsByTagName('html')[0].innerHTML;
// get a list of all <script> tags in the new page
var tmpScripts = document.getElementsByTagName('script');
if (tmpScripts.length > 0) {
// push all of the document's script tags into an array
// (to prevent dom manipulation while iterating over dom nodes)
var scripts = [];
for (var i = 0; i < tmpScripts.length; i++) {
scripts.push(tmpScripts[i]);
}
// iterate over all script tags and create a duplicate tags for each
for (var i = 0; i < scripts.length; i++) {
var s = document.createElement('script');
s.innerHTML = scripts[i].innerHTML;
// add the new node to the page
scripts[i].parentNode.appendChild(s);
// remove the original (non-executing) node from the page
scripts[i].parentNode.removeChild(scripts[i]);
}
}
Up until this point,
pagecrypthas used thesrcdocattribute om<iframe>elements. This has mostly worked well for simple apps and websites, but severely limited advanced apps to usepagecrypt.By removing the
<iframe>and also stop using thesrcdocattribute, we could bypass these restrictions.This would enable apps to use the full web platform instead of just using a small subset, which in turn would would make
pagecryptmore valuable. For example, this would enable developers to deploy SPA:s with routing and similar features currently not supported in the<iframe>when usingsrcdoc.Need to investigate potential solutions further, but here are some initial ideas:
document.write()(might have issues with injecting script)allow-same-origincombined withallow-scriptsare worth trying.DOMParserAPI looks promising to parse an entire document and replace with inline scripts. Need to test for advanced features though.