The HTML macro doesn't execute JavaScript code. It outputs HTML code that ends up being interpreted by the browser. So in order to prevent the execution of the JavaScript code that might be embedded in the HTML code generated by the HTML macro, the options are: (1) prevent the usage of the HTML macro (I don't know if it's possible right now, but it would be nice to be able to add a wiki macro, HTML in this case, to the list of wiki macros that require Script right in order to be executed) (2) add support for "cleaning" the JavaScript code from the output produced by the HTML macro (enabled with a parameter) (3) modify the HTML macro to require Script right when JavaScript code is detected Unfortunately none is implemented yet, afaik. On Fri, Apr 15, 2016 at 11:56 PM, Andrew Kuang <afkuang(a)gmail.com> wrote:

Thank you for the responses, Vincent and Marius. After playing around with the HTML macro, I came across a potential solution. It appears that all the XWiki-created pages reside within certain spaces (xwiki:Wiki, xwiki:WikiManager, etc). With that in mind, I was able to prototype an override for the HTML macro that whitelisted specific wiki spaces (Wiki, WikiManager, etc) and potentially lock down the creation/edit of pages in those spaces to the Admin group. This way we would be able to avoid conflicting with any existing Javascript usage while preventing outside (non-admin) users from using JavaScript on their pages. In the event that the page in question is not part of the whitelisted space and contains Javascript, we would return an error block with an error message instead of rendering the content passed into the HTML macro. I wanted to get any input on if this is a viable solution or if there are any crucial parts I may have overlooked that jeopardize this approach. Thank you! -- View this message in context: http://xwiki.475771.n2.nabble.com/Disabling-javascript-in-HTML-macro-tp7599… Sent from the XWiki- Users mailing list archive at Nabble.com.