Security:Strawman Model: Difference between revisions

Line 59: Line 59:


Informal subset EBNF grammar for an XHTML-like markup language, with embedded <i>semantics</i>, capitalized non-terminals, and quoted or lowercase terminals.  Unquoted terminals stand for the obvious lexical nonterminals, e.g. <code>tagname</code> is any valid HTML tag name other than those quoted tagnames used in the grammar (<code>button</code>, <code>iframe</code>, <code>script</code>).
Informal subset EBNF grammar for an XHTML-like markup language, with embedded <i>semantics</i>, capitalized non-terminals, and quoted or lowercase terminals.  Unquoted terminals stand for the obvious lexical nonterminals, e.g. <code>tagname</code> is any valid HTML tag name other than those quoted tagnames used in the grammar (<code>button</code>, <code>iframe</code>, <code>script</code>).
<pre>
Document ::= Content


Content ::= (text | Markup)*
  Document ::= Content


Markup ::= < tagname />
  Content ::= (text | Markup)*
          <i>doc.appendChild(new Node(tagname))</i>
 
        | < tagname >
  Markup ::= < tagname />
            <i>doc.pushChild(new Node(tagname))</i>
            <i>doc.appendChild(new Node(tagname))</i>
            Content
          | < tagname >
            <i>doc.setChildren(Content)</i>
              <i>doc.pushChild(new Node(tagname))</i>
          </ tagname >
              Content
          <i>doc.popChild()</i>
              <i>doc.setChildren(Content)</i>
        | < 'button' 'onclick' '=' string > text </ 'button' >
            </ tagname >
          <i>doc.appendChild(new Button(string, text))</i>
            <i>doc.popChild()</i>
        | < 'iframe' 'src' '=' string />
          | < 'button' 'onclick' '=' string > text </ 'button' >
          <i>doc.appendChild(new IFrame(string))</i>
            <i>doc.appendChild(new Button(string, text))</i>
        | < 'script' > text </ 'script' >
          | < 'iframe' 'src' '=' string />
          <i>doc.appendChild(new Script(text)); eval(text)</i>
            <i>doc.appendChild(new IFrame(string))</i>
</pre>
          | < 'script' > text </ 'script' >
            <i>doc.appendChild(new Script(text)); eval(text)</i>
Confirmed users, Bureaucrats and Sysops emeriti
419

edits