[ajax] use a custom tag to handle dynamically loaded js Using <pre class="script"> makes it trivial for a malicious user to inject arbitrary javascript into a html or rest text element (because it looks innocent to the html sanitizer). Using a custom tag we can be sure that it actually comes from our code and not from untrusted user data. IE ignores custom tags, though, so we put it in its own namespace. https://extranet.logilab.fr/1530578

     1

\.svn

     2

^build$

     3

^dist$

     4

\.pyc$

     5

\.pyo$

     6

\.bak$

     7

\.old$

     8

\~$

     9

\#.*?\#$

    10

\.swp$

    11

^doc/book/en/apidoc$

    12

\.old$

    13

syntax: regexp

    14

.*/data/database/.*\.sqlite

    15

.*/data/database/.*\.config

    16

.*/data/database/tmpdb.*

    17

.*/data/ldapdb/.*

    18

^doc/html/

    19

^doc/doctrees/

    20

^doc/book/en/devweb/js_api/