Bug 232614 - jsaction attribute not removed when enable-javascript-markup is disabled
Summary: jsaction attribute not removed when enable-javascript-markup is disabled
Status: RESOLVED INVALID
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-11-02 02:35 PDT by Milan Crha
Modified: 2021-11-02 09:45 PDT (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Milan Crha 2021-11-02 02:35:46 PDT
Using webkit2gtk3-2.34.0.

According to the documentation of the WebKitSettings::enable-javascript-markup:

> Determines whether or not JavaScript markup is allowed in document.
> When this setting is disabled, all JavaScript-related elements and
> attributes are removed from the document during parsing.

When the document has an element with a `jsaction` attribute and the markup is disabled, then this `jsaction` attribute is preserved.

I cannot tell whether it has any effect, but I'd expect it being removed the same as other attributes, like an `onclick` attribute.
Comment 1 Michael Catanzaro 2021-11-02 08:08:36 PDT
Hmmm, I think jsaction must refer to the third-party JS library https://github.com/google/jsaction. It doesn't appear to be a web standard that WebKit implements or knows about as we have zero hits for it anywhere in WebCore or JavaScriptCore, also zero hits on MDN. So I think this is not a bug. The attributes shouldn't do anything unless you run JS that makes them do something. Please reopen if I've misunderstood something.
Comment 2 Milan Crha 2021-11-02 09:45:07 PDT
Right, it looks like some 3rd-party thing (which I saw for the first time today). I probably won't care that much, if the WebKit sources did not reference it at all, but there are some hits in the PerformanceTests/.

Anyway, if it's not interpreted by the WebKit, neither a module loaded by it, then it's fine. I'd be happier with a safe side, drop it too, but I'm not reopening this.