googlearchive / caja

Caja is a tool for safely embedding third party HTML, CSS and JavaScript in your website.
Apache License 2.0
1.13k stars 114 forks source link

Should whitelist tags that can appear in the ancestor chain of a container node. #1490

Open kpreid opened 9 years ago

kpreid commented 9 years ago

Original issue 1490 created by metaweta on 2012-07-03T21:39:19.000Z:

Putting anchors as children of anchor tags causes strange rearrangements of the content when innerHTML is changed. Tables are similarly problematic. We should whitelist those tags that behave sensibly and throw if the host page attempts to call attachDocument where it would be unsafe to do so.

kpreid commented 9 years ago

Comment #1 originally posted by kpreid@google.com on 2013-11-11T18:31:10.000Z:

<empty>