Why is the HTML macro restricted in Confluence OnDemand?

[Bruce Henry]

Okay, I know... "Security".

But that's like saying, "Mommy says so." It doesn't really answer the question. What specifically are you securing? It seems to me that the only thing I could expose or compromise is my own Confluence site.

Can I get a bit more detail? We _really_ need this macro. The iFrame macro does not resize (or several other things) with the content and is a truely suboptimal workaround.

[Matthew J. Horn]

"cross-site scripting".

I bet your mommy never said that. :)

[Peter Van de Voorde]

Hi Bruce,

You could actually expose the entire server structure that is not only supporting your own confluence site but countless others.

Sometimes Mommy is right :)

If you really need this feature why don't you consider a Confluence you host yourself?

Best regards,

Peter