Re: A perfect DOM sandbox

On 16 February 2011 23:02, Giorgio Maone <g.maone@informaction.com> wrote:

> Actually impl.createHTMLDocument() returns a document including head and
> body elements, so you can just do
>
> body = document.implementation.createHTMLDocument().body;
>
> body.innerHTML = "<img src=x onload=alert(1) onerror=alert(1)>";
> alert(body.innerHTML);
>

This stuff is really nice and the ff4/3.6. How would you read the data back
in order to add it to the DOM? Since we can't trust innerHTML or DOM styles
:(