Re: Barewords in on* attributes, redux (also, find() and company)

On Tue, Dec 13, 2011 at 11:36 PM, Boris Zbarsky <bzbarsky@mit.edu> wrote:
> John Jensen here at Mozilla has been doing some web crawling trying to find
> what barewords are used in on* attributes.
>
> What I have so far as a result is a list of about 1.7 million barewords used
> across several tens of thousands of pages.  If people are interested in the
> exact methodology, I can probably get a description. I'm working on making
> sure that it's ok for me to post the data in its entirety so you can all
> look as well.  Assuming it is (very likely), where's a good place to stick a
> 7MB compressed file?
>
> In any case, for this particular data set there are no hits on "findAll" or
> "matches" (good!), but there are two hits on "find" as a bareword in an on*
> attribute.  Specifically:
>
> 1)  http://otc-pif.rbc.ru/pif_calculator/calculator.jsp has
> onclick="find(document.getElementById(current + 'List').children,
> searchString.value)"
>
> 2)  http://bookmark.people.com.cn/index.html has onclick="find()"
>
> These would both obviously get broken by the proposed find() API, unless we
> actually do some sort of workaround for this problem...

This doesn't really tell us weather access to expandos on the
element/form is strictly needed or not, right? This since both
expandos and global properties show up as barewords.

/ Jonas

Received on Wednesday, 14 December 2011 23:49:33 UTC