Re: CSP/innerHTML/JS Sandbox

It seems one can do:
var doc = document.implementation.createHTMLDocument(''); var r =
doc.createRange(); r.selectNodeContents(doc.body); var df =
r.createContextualFragment("<a href=javascript:alert(1) onclick=alert(2)>");

And then do a whitelist over the document fragment nodes, and then import
the node into the current document. Apparently, documents without a view
don't execute javascript.