DescriptionScript tags support a language attribute which causes a different language interpreter
to be used on the contents of the script block. This increases the attack surface that
needs to be understood. An alternative is to translate source languages into a single
or a small number of target languages which can then be understood and secured.
This mechanism would also be useful to simplify the composition of a web page that has
a mix of trusted (that needs to be innocent-transformed) code and untrusted (that needs
to be cajoled) as well as allow a page to be coded in a mix of langauges (e2js, caja,
gwt, flapjacks).
Patch Set 1 #
Total comments: 1
Patch Set 2 : Support for extending script tags to support other languages via translation #MessagesTotal messages: 5
|