Mike Samuel

> It could also be used to identify when Eval Villain is hooking eval in the page. Yeah. ```js function isEvalHooked() { var Object = 0; // Mask the global....

> Probably, it wouldn't even need expect clauses because the pure packages should not have any IO or other platform dependent code. Yeah. I could put the non-pure packages under...

Could the problem be here? https://github.com/gradle/gradle-completion/blob/5c863bf6e6702bb763051d2bc74220bf9e922f4c/gradle-completion.bash#L204-L208 IIUC that filters text like ``` assemble - Assembles the outputs of this project. bar:assemble - Assembles the outputs of this project. :bar:assemble -...

My bash is kind of weak right now though.

```html link const { href } = document.querySelector('a'); document.body.appendChild(document.createTextNode(href)) ``` Firefox and Safari show the href as `javascript:alert(1)//#`. Chrome rejects the ``.

In Google internal code, we allow deriving a TrustedScriptURL from a TrustedScriptURL by adding query parameters or changing the hash. That seems similar to the consequences of ``

Ditto `useInternalBidiFlipper`.

I use [TopoSort](https://github.com/mikesamuel/closure-maven-plugin/blob/master/plugin/src/main/java/com/google/closure/plugin/common/TopoSort.java) for this in closure-maven-plugin.

> Ok, so I poked around a bit there. Let me know when you have some docs, because I can't (at least in the small time I have right now)...

> I don't see any replies for the bugs(?) I think I found and would love to hear back on those. Looking at this again. Will address those and others...