ampproject / ampproject/worker-dom

Script tags created by innerHTML should not execute when synced to main thread

Open
#311 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
3.3k
Forks
154
PR merge metrics
No merged PRs in 30d

Description

After https://github.com/ampproject/worker-dom/issues/283, we should fix the thread mutation sync so that script elements don't execute on the main thread:

```js
div.innerHTML = `
alert("I won't execute");
`;
```

When we do this, we should also ensure that regularly created script elements _do_ execute:

```js
const s = document.createElement('script');
s.textContent = `alert("I will execute");`;
div.appendChild(s);
```

- - -

One way to do this would be to add a `_disabled` flag to the node. When using innerHTML, `script._disabled = true`. When it's being recreated on the main thread, we can do the following:

```js
const throwaway = document.createElement('div');
throwaway.innerHTML = ``;
const script = throwaway.firstChild;
```

A script created like this will not be able to execute.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the thread mutation sync handling for innerHTML-created script elements, then compare it with the document.createElement and appendChild path shown in the issue. Verify that scripts synced from innerHTML do not execute on the main thread while regularly created scripts still do.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, typescript
Domain
frontend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.