vojtech-dobes/nette.ajax.js — pull request #89 by vojtech-dobes (2014-05-24 13:48:30+00:00)
Title: Mitigation of Mutation XSS attacks [WIP]

Fixes #88. **Work in progress.**

/cc @mishak87: is this correct approach? If this is correct implementation of *TrueHTML*, then 2 points must be resolved:

- [ ] *TrueHTML* cannot be used if `Object.defineProperty` is not available (or broken in IE8) OR `XmlSerializer` isn't available
- [ ] if TrueHTML cannot be used:
- [ ] 1. HTML must be sanitized in different way
- [ ] 2. nette.ajax.js will refuse to update snippet
- [ ] 3. nette.ajax.js will update snippet but scream about security hole