Script inside SVG?

In my view copying HTML verbatim should not be dangerous *in a help browser*. Whatever it does with the HTML should involve displaying it, not executing any scripts.

It can check the HTML too, making sure it doesn't have <script> elements, to present a useful error message -- but that shouldn't be the only defence. The writeup notes: "Simply appending a script tag or a malicious on* attribute in the input XML document won't work since handling these tags is not defined in the yelp-xsl app." Which is great, but an oversight in the XSL processing shouldn't open the door to arbitrary scripting.

I think WebKitGtk needs a mode without any JavaScript support, and this should even be the default (since there are hundreds of little programs that just want to display some HTML in their splash screen or help text with a few lines of code, while writing a web browser is a less common task).