[Edbrowse-dev] var elem = document.querySelector('script[nonce]');

[Edbrowse-dev] var elem = document.querySelector('script[nonce]');

[Kevin Carhart]

I found out a little more about freecarrierlookup.com.  Sorry to send a 
part one and part two.

It seems that freecarrierlookup wants some variations on our 
querySelectorAll.. also, or maybe this discovery is actually the main 
issue, and I'm mistaken about the <image onclick> question.

Because I actually noticed that when you fire i1* on the 
freecarrierlookup submit, does it do nothing and not parse?  It actually 
does not do nothing.  I think in the old days, it would just not 
understand the element and give you a question mark.  That is no longer 
the case.  It runs quite a bit, just not to complete success, to xhr and 
back.

So here's what I found using demin, showscripts and ^>

It wants a document.querySelector which works like querySelectorAll but 
returns just the first hit.  I've known about this for a while.. there are 
both.

It's complaining about line 15 of the following.

(function () {
     if (!window['___grecaptcha_cfg']) {
         window['___grecaptcha_cfg'] = {};
     }
     ;
     if (!window['___grecaptcha_cfg']['render']) {
         window['___grecaptcha_cfg']['render'] = 'onload';
     }
     ;
     window['__google_recaptcha_client'] = true;
     var po = document.createElement('script');
     po.type = 'text/javascript';
     po.async = true;
     po.src = 'https://www.gstatic.com/recaptcha/api2/r20170919161736/recaptcha__en.js';
     var elem = document.querySelector('script[nonce]');
     var nonce = elem && (elem['nonce'] || elem.getAttribute('nonce'));
     if (nonce) {
         po.setAttribute('nonce', nonce);
     }
     var s = document.getElementsByTagName('script')[0];
     s.parentNode.insertBefore(po, s);
}());

Re: [Edbrowse-dev] var elem = document.querySelector('script[nonce]');

[Kevin Carhart]

> Regarding querySelect, as you see, http://freecarrierlookup.com now runs, so I don't know if this is still an issue or not.

Well, in freecarrierlookup, it occurred in some pointless google code.  I 
thought it might be necessary if the google code made the parser bail out 
and not run whatever is next, either.  But I think this was a mistake.
One slight good thing is that I think probably google ads code is modular 
a lot of the time, so if the parser hits a runtime, the ads code did not 
have crucial interoperability with the site operation.  They *could* 
intermingle the two things but in the real world, they usually won't. 
Google code is being slotted in like a widget.  The freecarrierlookup 
developer is not going to intermingle it with their own work unless they 
have to.

So we don't need it right now.

As for generally, I don't know.  We could wait and see.  But I think all 
it needs to be is something like,
document.querySelector = function(x) {
return querySelectorAll(x)[0]
}
unless you think the resource hit of selecting all just to throw away the 
rest would be not trivial in the case of a 
large tree.  In that case, unlike getElements, we can't go into the 
recursive traversal and say "stop working once you hit the first one," 
because it's third party code.  But if we get that far, I am pretty sure 
the third party code actually exposes querySelector.  I seem to 
remember this.  The single and multiple are both in MDN:

https://developer.mozilla.org/en-US/docs/Web/API/Document/querySelector
https://developer.mozilla.org/en-US/docs/Web/API/Element/querySelector
https://developer.mozilla.org/en-US/docs/Web/API/Document/querySelectorAll
https://developer.mozilla.org/en-US/docs/Web/API/Element/querySelectorAll