New issue
Advanced search Search tips

Issue 921150 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Jan 15
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

script tag is not executed by importNode

Reported by a.goed...@googlemail.com, Jan 11

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36

Steps to reproduce the problem:
1. create a template element using document.createElement
2. set the innerHTML to '<script>alert("hello");</script>'
3. call document.importNode(template.content, true);

What is the expected behavior?
alert should be executed

What went wrong?
It does not.

Did this work before? N/A 

Chrome version: 71.0.3578.80  Channel: n/a
OS Version: 
Flash Version: 

A similar bug https://bugs.chromium.org/p/chromium/issues/detail?id=572693 has been fixed a while back. The test case provided there can be used to reproduce the issue. Maybe re-opening that bug would be ok? Test case from that bug: http://jsbin.com/hocine/edit?html,output
 
Labels: Needs-Triage-M71
The linked bug is about an entire <template> with a <script> being inside another element's HTML so it's not related.
The behavior you observe here is correct and matches the specification AFAICT.
https://html.spec.whatwg.org/multipage/scripting.html#htmltemplateelement

A <template> element doesn't have any children so there's no point in setting its innerHTML.
You can use its "content" property:

    var t = document.createElement('template');
    t.content.appendChild(document.createElement('script')).textContent = 'alert("hello")';
    document.documentElement.appendChild(document.importNode(t.content, true));

In order to actually run a script you need to make sure it's not "inert" as defined in the above spec:
* create the script element manually via createElement 
* attach the script element to the live DOM

The specification says the only case when the scripts aren't inert is when the <template> was present in the original opened document so for example this test.html runs the template's script:

    <template id=tpl>
      <script>alert("hello");</script>
    </template>
    <script>
      document.documentElement.appendChild(document.importNode(tpl.content, true));
    </script>
Thanks for taking the time to explain this. Sorry for filing a bug about behavior which is correct!
Components: -Blink Blink>HTML>Script
Status: WontFix (was: Unconfirmed)

Sign in to add a comment