{"action":"created","issue":{"url":"https://api.github.com/repos/evancz/elm-html/issues/45","labels_url":"https://api.github.com/repos/evancz/elm-html/issues/45/labels{/name}","comments_url":"https://api.github.com/repos/evancz/elm-html/issues/45/comments","events_url":"https://api.github.com/repos/evancz/elm-html/issues/45/events","html_url":"https://github.com/evancz/elm-html/issues/45","id":60414826,"number":45,"title":"Disallow script tags","user":{"login":"TheSeamau5","id":3227869,"avatar_url":"https://avatars.githubusercontent.com/u/3227869?v=3","gravatar_id":"","url":"https://api.github.com/users/TheSeamau5","html_url":"https://github.com/TheSeamau5","followers_url":"https://api.github.com/users/TheSeamau5/followers","following_url":"https://api.github.com/users/TheSeamau5/following{/other_user}","gists_url":"https://api.github.com/users/TheSeamau5/gists{/gist_id}","starred_url":"https://api.github.com/users/TheSeamau5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheSeamau5/subscriptions","organizations_url":"https://api.github.com/users/TheSeamau5/orgs","repos_url":"https://api.github.com/users/TheSeamau5/repos","events_url":"https://api.github.com/users/TheSeamau5/events{/privacy}","received_events_url":"https://api.github.com/users/TheSeamau5/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-03-09T21:40:46Z","updated_at":"2015-03-12T05:32:14Z","closed_at":null,"body":"As pointed out in [this discussion in the mailing list](https://groups.google.com/forum/#!topic/elm-discuss/CH6IlSqcV-U), it is possible to inject arbitrary Javascript in Elm using elm-html by defining a `script` tag.\r\n\r\n```elm\r\nimport Html (..)\r\nimport Html.Attributes (..)\r\n\r\n\r\nscript : String -> Html\r\nscript string =\r\n  node \"script\" [] [text string]\r\n\r\nmain =\r\n  script \"alert('Hello World');\"\r\n```\r\n\r\nThere may be value to using `script` tags to load Javascript files, but the fundamental problem is that this violates the integrity of the Elm code. This is especially a problem if Elm components are intended to be shared and then one can suddenly inject Javascript into your code and do all sorts of nasty things. \r\n\r\nIf Javascript is really necessary and ports are not a viable option, then one should use Native modules which at the very least can be checked and flagged. This is uncheckable and unflaggable. "},"comment":{"url":"https://api.github.com/repos/evancz/elm-html/issues/comments/78426337","html_url":"https://github.com/evancz/elm-html/issues/45#issuecomment-78426337","issue_url":"https://api.github.com/repos/evancz/elm-html/issues/45","id":78426337,"user":{"login":"rtfeldman","id":1094080,"avatar_url":"https://avatars.githubusercontent.com/u/1094080?v=3","gravatar_id":"","url":"https://api.github.com/users/rtfeldman","html_url":"https://github.com/rtfeldman","followers_url":"https://api.github.com/users/rtfeldman/followers","following_url":"https://api.github.com/users/rtfeldman/following{/other_user}","gists_url":"https://api.github.com/users/rtfeldman/gists{/gist_id}","starred_url":"https://api.github.com/users/rtfeldman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rtfeldman/subscriptions","organizations_url":"https://api.github.com/users/rtfeldman/orgs","repos_url":"https://api.github.com/users/rtfeldman/repos","events_url":"https://api.github.com/users/rtfeldman/events{/privacy}","received_events_url":"https://api.github.com/users/rtfeldman/received_events","type":"User","site_admin":false},"created_at":"2015-03-12T05:32:14Z","updated_at":"2015-03-12T05:32:14Z","body":"Alternatively, I haven't checked how `virtualdom` handles this, but certainly you can already get a runtime exception from manually calling `document.createElement(\"$$$\")` (or any other invalid tag name), so there must be some existing precedent for what happens when you try to use an invalid string; presumably `\"script\"` could be treated as invalid in the same way that `\"$$$\"` is."}}