You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Will this script run? <script>document.write('YES!');</script><noscript>No!</noscript>
It would make sense to me if the AMP plugin would automatically take the child elements of the noscript element to take the replace of the script element that is sanitized from the document. This would ensure that any fallback behavior would run as intended for browsers that have JS disabled.
For example, Google Tag Manager advises using the following HTML:
<!-- Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
newDate().getTime(),event:'gtm.js'});varf=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-XXXX');</script><!-- End Google Tag Manager --><!-- Google Tag Manager (noscript) --><noscript><iframesrc="https://www.googletagmanager.com/ns.html?id=GTM-XXXX"
height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript><!-- End Google Tag Manager (noscript) -->
When this gets served as AMP, then this could get all replaced with the contents of noscript, namely:
This would make sense as part of the AMP_Script_Sanitizer as proposed in #1032. When the script sanitizer does this replacement, it could result in bypassing the pass-through of the script element to the whitelist sanitizer and thus avoid raising a blocking validation error. And again, the fallback behavior would be preserved.
The text was updated successfully, but these errors were encountered:
Note that most of the work in this issue has been done already via #1226. What remains is determining a way to link a noscript with an adjoining script for the purposes of bypassing a validation error. This may not be feasible.
I don't think this is going to be feasible, or at least not reliable. Often a noscript for a script may not be adjacent, and who knows whether a noscript is for the script before or after.
If a theme or plugin outputs something like:
It would make sense to me if the AMP plugin would automatically take the child elements of the
noscript
element to take the replace of thescript
element that is sanitized from the document. This would ensure that any fallback behavior would run as intended for browsers that have JS disabled.For example, Google Tag Manager advises using the following HTML:
When this gets served as AMP, then this could get all replaced with the contents of
noscript
, namely:This would make sense as part of the
AMP_Script_Sanitizer
as proposed in #1032. When the script sanitizer does this replacement, it could result in bypassing the pass-through of thescript
element to the whitelist sanitizer and thus avoid raising a blocking validation error. And again, the fallback behavior would be preserved.The text was updated successfully, but these errors were encountered: