ampproject / ampproject/worker-dom
Script tags created by innerHTML should not execute when synced to main thread
- Dominant language
- TypeScript
- Stars
- 3.3k
- Forks
- 154
- PR merge metrics
- No merged PRs in 30d
Description
After https://github.com/ampproject/worker-dom/issues/283, we should fix the thread mutation sync so that script elements don't execute on the main thread:
```js
div.innerHTML = `
alert("I won't execute");
`;
```
When we do this, we should also ensure that regularly created script elements _do_ execute:
```js
const s = document.createElement('script');
s.textContent = `alert("I will execute");`;
div.appendChild(s);
```
- - -
One way to do this would be to add a `_disabled` flag to the node. When using innerHTML, `script._disabled = true`. When it's being recreated on the main thread, we can do the following:
```js
const throwaway = document.createElement('div');
throwaway.innerHTML = ``;
const script = throwaway.firstChild;
```
A script created like this will not be able to execute.
Contributor guide
Research direction
Start by tracing the thread mutation sync handling for innerHTML-created script elements, then compare it with the document.createElement and appendChild path shown in the issue. Verify that scripts synced from innerHTML do not execute on the main thread while regularly created scripts still do.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100