Why does this make me think of white listing javascript based on what the javascript eventually compiles into. Could have to do with all those web sites which time and again prove too trivial to make display whatever the blackhat wants to today.