我刚刚开始使用LinkedIn JavaScript API,我马上发现了一个我不熟悉的模式:
我有两个问题:
> api_key对象的类型和范围是什么?
>引用的脚本是否具有对脚本标记中内容的特殊访问权限,因为它是标记的src?
编辑:
根据Douglas Crockford(强调我的):
The src attribute is optional. If it is present,then its value is a
url which identifies a .js file. The loading and processing of the
page pauses while the browser fetches,compiles,and executes the
file. The content between the.
should be blankIf the src attribute is not present,then the content text between the
is compiled and executed
.
在我看来,LinkedIn示例不符合这些要求.
What is the type and scope of the api_key object?
如果你把它当作JavaScript那么……
它是一个label,后跟一个(推测)未定义的变量,它会抛出一个引用错误.
Does the referred script have special access to the content in the script tag because its the src of the tag?
否.脚本元素的内容是不支持src时的后备.它被滥用作为包含额外数据的黑客.浏览一下脚本(在src中)表明它遍历所有< script>它可以找到并检查其innerHTML的元素.