Re: [whatwg/dom] Declarative Shadow DOM (#831)

> Therefore, for security purposes, it is not acceptable to skip sanitizing dangerous code like `<script>` and onmousemove attributes inside `<template>`. At the very least, that will pwn your IE11, Opera Mini, and Safari 7 users.

FWIW in [uce-template](https://github.com/WebReflection/uce-template#readme), which already does pretty much everything discussed in here regarding SSR, I've solved IE11 (and other legacy) `<script>` issue by simply using/requiring `type="module"`, which is also not supported by legacy browsers, including IE11, and if there is a `template {display:none}` on top no `mousemove` or other events can happen.

Requiring a `display:none` could be also used as inline `style` and it looks like a very easy workaround for legacy only, whenever legacy will be even a desired target once this new spec ships cross browser and is widely adopted.



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/issues/831#issuecomment-717104273