Home/ Questions/Q 8128429
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T07:52:44+00:00

what does WinJS.strictProcessing() do? MSDN’s explanation is not very helpful – http://msdn.microsoft.com/en-us/library/windows/apps/hh987021.aspx

  • 0

what does WinJS.strictProcessing() do?

MSDN’s explanation is not very helpful – http://msdn.microsoft.com/en-us/library/windows/apps/hh987021.aspx

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It turns on a security feature. The scenario is this:

    1. App downloads HTML from the web (over XHR for example) that includes data-win-control, data-win-options, or data-win-bind attributes
    2. The HTML is added to the DOM
    3. WinJS.UI.processAll or WinJS.Binding.processAll is called on that HTML
    4. The data-win-* attributes specify functions that get tricked into calling eval (or something equally evil)
    5. User’s app is owned

    When strictProcessing mode is turned on, only functions that are explicitly marked as safe for declarative processing can be called from markup. This reduces the surface area of functions that can be called significantly, and reduces the areas of your app that need to be security reviewed.

    Most importantly, none of the WinRT or the eval function are so marked, so you can’t get downloaded HTML to call the WinRT directly (before, you could).

    This mode wasn’t turned on by default in RC to give app developers time to adjust their code before they get broken, but this behavior will be most likely be on by default in RTM.

    • 0