Hey Phil, Thanks for the reply. I understand where you are coming from, and I applaud you for taking security seriously, but I'm not convinced that you've got the balance quite right. I'm not for one moment suggesting that you allow arbitrary HTML, or the injection of generic stylesheets into the site. I'm merely suggesting that you allow people to put style attributes onto the limited HTML that you support within tightly controlled contexts without messing with them unduly. The handout dialog has overflow:hidden on it; the worst a malicious agent could conceivably achieve would be to reskin the handout dialog to look like a login box of some description. This would be really very challenging to achieve and would at worst save the supplied information to the user's campaign data somewhere. It's a pretty poor attack for a lot of effort and almost no gain. I think part of the problem is that there isn't a one-size-fits-all answer to this across the site. Campaign handouts and the campaign chat window seem like they are much lower risk than, for example, forum posts - they're closely monitored by a very limited set of users who have a close relationship to the creation of the content in them and are going to be much more likely to notice something out of place. I'd reiterate my original assertion - I strongly suspect that for most Roll20 users, having their whole campaign trashed by an API script is likely to be worse than any of the other credible attack vectors - and I'd follow it up with a challenge: can you describe, even in rough outline, a way in which allowing arbitrary style attributes (not elements) on controlled HTML inside a handout could result in some harm to your users that is worse than what is already possible? Since you can't send data anywhere (no scripts, no forms, no external links without warning), I'm struggling to see how making things look different (and only within the outline of the handout dialog) would really make much difference to the risk level. Hell, I'm sure you can already do *much* worse using a character sheet, which supports form controls! If you're really still adamant that this is too risky, then I'd encourage you to give some serious thought to the idea of some sort of simple code-signing scheme in the future. In the end, trying to prevent people from Doing Bad Things On The Internet is a losing battle; it's a lot more effective to help build trust networks rather than trying to police the untrusted. It wouldn't be hard to accept a digital signature along with a script (perhaps in exchange for permission to do more), and that way you'd remove most of the risk of scripts from unknown sources.
