mirror of
https://github.com/zotero/zotero.git
synced 2026-08-28 05:25:31 +00:00
3a54a5ecb1
allowJavaScript: false didn't disable scripts for a system-principal document, such as a blob: URL created from chrome code, which runs scripts regardless of the allowJavascript flag. Sandbox the document instead, forcing a null principal and blocking script execution.
14 lines
246 B
HTML
14 lines
246 B
HTML
<html>
|
|
<head>
|
|
<meta charset="utf-8"/>
|
|
</head>
|
|
<script>
|
|
window.onload = function () {
|
|
document.getElementById('target').textContent = 'This is a test.';
|
|
};
|
|
</script>
|
|
<body>
|
|
<p>Static content</p>
|
|
<p id="target"/>
|
|
</body>
|
|
</html>
|