W3C home > Mailing lists > Public > public-script-coord@w3.org > January to March 2013

RE: E4H and constructing DOMs

From: Domenic Denicola <domenic@domenicdenicola.com>
Date: Sat, 9 Mar 2013 02:04:49 +0000
To: Adam Barth <w3c@adambarth.com>, Allen Wirfs-Brock <allen@wirfs-brock.com>
CC: Jonas Sicking <jonas@sicking.cc>, Anne van Kesteren <annevk@annevk.nl>, Rick Waldron <waldron.rick@gmail.com>, Adam Klein <adamk@chromium.org>, Ojan Vafai <ojan@chromium.org>, Brendan Eich <brendan@secure.meer.net>, Ian Hickson <ian@hixie.ch>, "rafaelw@chromium.org" <rafaelw@chromium.org>, Alex Russell <slightlyoff@chromium.org>, "public-script-coord@w3.org" <public-script-coord@w3.org>, "Mark S. Miller" <erights@google.com>
Message-ID: <B4AE8F4E86E26C47AC407D49872F6F9F6EF7E022@BY2PRD0510MB354.namprd05.prod.outlook.com>
From: Adam Barth [mailto:w3c@adambarth.com] 

> Right, that's why the example in my first email is XSS:

>     var firstName = [...];
>     var lastName = [...];
>     header.innerHTML = `<h1>Welcome ${ firstName } ${ lastName }!</h1>`;

> Whereas the E4H equivalent would not be:

>     var firstName = [...];
>     var lastName = [...];
>     header.appendChild(@<h1>Welcome { firstName } { lastName }!</h1>);


I must be missing something, but from my reading you are not gaining anything in the ES4H example over the string templates example, if of course you modify the last line to be

    header.innerHTML = html`<h1>Welcome ${ firstName } ${ lastName }!</h1>`;

In particular, as has been explained in this thread a few times, there's no reason why browsers can't ship a built-in `html` template handler that does the same AST-based DOM parsing on the passed template string that ES4H would do on the source string following the @-sign, and subsequently returns the `outerHTML` of the resulting DOM element. Indeed, since string templates don't even need to return strings, you could do

    header.appendChild(htmlel`<h1>Welcome ${ firstName } ${ lastName }!</h1>`);

where `htmlel` just returns an HTML element constructed using that same algorithm (instead of the `outerHTML` of that element).

At this point it seems like you are bikeshedding over `@` vs. `htmlel` or `{}` vs. `${}`, which leads me to believe I must be missing your argument, especially since you emphasize you're not wedded to ES4H and thus presumably not wedded to `@` or `{}`. 

Look forward to hearing what I missed!
Received on Saturday, 9 March 2013 02:05:25 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 8 May 2013 19:30:09 UTC