Disable Javascript from cross-domain file

Question

I have an html file which intends to load XHR html files. Here is my code:

<div id='some-id'></div>
<div id='some-id-2'></div>
<script type='text/javascript'>
$('#some-id').load('some-url');
</script>

My problem is the external html file contains some javascript code which is executed after embedding it. How can I prevent this problem? (The url is cross-domain and I do not have permission to the remote domain server)

use ajax and inject via $('#some-id')[0].innerHTML= instead of .html() (called internally by load) — dandavis
– dandavis, Commented Jul 9, 2013 at 15:29
@Samuel, does the content from some-url have a single top-level element? If that's the case, you can specify a selector matching that element after the URL and load() will strip the scripts. — Frédéric Hamidi
– Frédéric Hamidi, Commented Jul 9, 2013 at 15:30
Does loading the external file work at all (and if so, how are you working around SOP)? What's wrong with executing the scripts? — Bergi
– Bergi, Commented Jul 9, 2013 at 15:32
Bergi, all things went well. What I want to do is only to disable Javascript from remote source. — user2467577
– user2467577, Commented Jul 9, 2013 at 15:35

Community · Accepted Answer · 2017-05-23 12:29:00Z

5

Might not be the best solution, but since you can't control the returning data -

You can load only some of the HTML, e.g. only the elements that interest you:

$('#some-id').load('http://www.some-url.com/index.html div#elementId');

Also, like apsillers mentioned, you can exclude the script:

$('#some-id').load('http://www.some-url.com/index.html :not(script)');

Or, you could remove it at return level:

$.get('http://www.some-url.com/index.html', function(data) {
    $(data).find('script').remove();
    $('#some-id').html(data);
});

edited May 23, 2017 at 12:29

CommunityBot

11 silver badge

answered Jul 9, 2013 at 15:32

casraf

21.8k10 gold badges60 silver badges93 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user2467577 Over a year ago

No use because the javascript code remote has been executed before setting this command.

casraf Over a year ago

If it doesn't get inserted into the DOM, it shouldn't be executed - try the $.get method

user2467577 Over a year ago

Still the same when I use get method.

Collectives™ on Stack Overflow

Disable Javascript from cross-domain file

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related