metafizzy / metafizzy/infinite-scroll
[Feature Request] Secure Only Mode
- Dominant language
- HTML
- Stars
- 7.5k
- Forks
- 1.7k
- PR merge metrics
- No merged PRs in 30d
Description
Currently, InfiniteScroll allows for external scripts within embedded content.
Would be nice to have a "secure only" mode parameter, which passes all html through [DOMPurify](https://github.com/cure53/DOMPurify) before calling `innerHTML` (or ideally right after fetching the new html). Additionally, "secure only" mode would not attempt to call `refreshScripts()` to prevent external scripts from ever loading.
Contributor guide
Research direction
Start by locating the embedded-content fetch path and the code that assigns innerHTML or calls refreshScripts(). Add a secure-only parameter that sanitizes fetched HTML with DOMPurify before insertion and skips refreshScripts(); done means external scripts cannot load in that mode.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100