<core-style> should use an element that parses in plain text mode

[esprehn]

ex.

<style is="core-style" type="polymer/style">
    .span::before { content: "<script>alert(1)</script>"; }
</style>

Using today to do that will alert since it just has random HTML inside it which is both slower for the parser, and will interpret stuff inside it as tags. Instead it should work as above.

[esprehn]

An alternative is to use a nested element like:

<core-style>
   <style type="polymer">
   </style>
</core-style>

[sjmiles]

Can you explain why the nested element is different from the first example?

[esprehn]

It's not really different, depends on what polymer prefers. Doing is@ syntax also means that when using the style the custom element can just change itself directly and not appendChild a sibling.

ex.

<style is="core-style" ref="..."></style>

[sjmiles]

So, both of your examples are 'the good way'? Reading your first post, it sounded like you were saying if we did it as in the example you provided, there would be an alert. Sorry if I'm being dense.

I understand the notion of using a special type to avoid the parser becoming confused. It seemed like you were pointing to a derivative problem, but I likely read too much in.

[esprehn]

Oh sorry, I wrote this bug in the most confusing way possible. Currently does this:

<core-style>
    .span::before { content: "<script>alert(1)</script>"; }
</core-style>

which will alert, since the content of the core-style is parsed as tags.

So polymer should either use <style is="core-style" type="polymer"> (or <script>) or use a nested <style> inside the <core-style>.

It's also bad to use the text content since the parser is not in the fast text mode for large style blocks.

[sorvell]

Thanks for highlighting this Elliot.

We actually may want to allow elements inside core-style because it let's nest <template>'s. In that case, I guess we need to wrap the content in a template or extend template.

[tjsavage]

auto-moving this issue to googlearchive/core-style#5 and closing this one