Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add setHTMLUnsafe and parseHTMLUnsafe methods #9538

Merged
merged 27 commits into from
Oct 11, 2023
Merged

Add setHTMLUnsafe and parseHTMLUnsafe methods #9538

Changes from 21 commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
8ec596c
Add setHTMLUnsafe and parseHTMLUnsafe methods
josepharhar Jul 19, 2023
345c888
wrote more stuff
josepharhar Jul 20, 2023
63abb16
fix idl
josepharhar Jul 20, 2023
5dea87f
make parsehtmlunsafe static
josepharhar Jul 20, 2023
ff03967
resolve todo
josepharhar Aug 8, 2023
bebbe37
Merge remote-tracking branch 'upstream/main' into sethtml
josepharhar Aug 8, 2023
3b7e41f
improve idl
josepharhar Aug 15, 2023
b1438c7
add domparser heading
josepharhar Aug 15, 2023
cb99174
typo + static
josepharhar Aug 15, 2023
7a7c1ee
feedback
josepharhar Aug 15, 2023
086e203
fix fragment parsing reference
josepharhar Aug 15, 2023
4909dc6
nits
josepharhar Aug 15, 2023
39dca26
nits
josepharhar Aug 22, 2023
d522f14
more nits
josepharhar Aug 22, 2023
b3e163e
add to shadowroot
josepharhar Aug 24, 2023
34027c9
merge shadowroot into documentorshadowroot and hoist template
josepharhar Aug 26, 2023
8c5386d
domstring
josepharhar Aug 26, 2023
aa3e231
add missing li
josepharhar Aug 26, 2023
46bc656
Merge branch 'main' into sethtml
josepharhar Sep 5, 2023
6ed235b
move shadowroot to dynamic markup insertion
josepharhar Sep 6, 2023
e28361b
string->html
josepharhar Sep 6, 2023
3fed030
stuff
josepharhar Sep 21, 2023
090d6a8
add scripting note
josepharhar Sep 21, 2023
b6f859c
say which element provides context to parser
josepharhar Sep 21, 2023
31ade1b
note->warning
josepharhar Sep 21, 2023
0c1331e
,->;
josepharhar Sep 21, 2023
d8e8f2c
Final touches
domenic Oct 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
139 changes: 121 additions & 18 deletions source
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10579,6 +10579,8 @@ typedef (<span>HTMLScriptElement</span> or <span>SVGScriptElement</span>) <dfn t

[<span>LegacyOverrideBuiltIns</span>]
josepharhar marked this conversation as resolved.
Show resolved Hide resolved
partial interface <dfn id="document" data-lt="">Document</dfn> {
static <code>Document</code> <span data-x="dom-parseHTMLUnsafe">parseHTMLUnsafe</span>(DOMString html);

// <span>resource metadata management</span>
[PutForwards=<span data-x="dom-location-href">href</span>, <span>LegacyUnforgeable</span>] readonly attribute <span>Location</span>? <span data-x="dom-document-location">location</span>;
attribute USVString <span data-x="dom-document-domain">domain</span>;
Expand Down Expand Up @@ -109055,6 +109057,8 @@ document.body.appendChild(frame)</code></pre>
also live here? -->
josepharhar marked this conversation as resolved.
Show resolved Hide resolved
<h3 id="dom-parsing-and-serialization">DOM parsing</h3>

<h4>The <code>DOMParser</code> interface</h4>

annevk marked this conversation as resolved.
Show resolved Hide resolved
<p>The <code>DOMParser</code> interface allows authors to create new <code>Document</code> objects
by parsing strings, as either HTML or XML.</p>

Expand Down Expand Up @@ -109115,7 +109119,7 @@ enum <dfn enum>DOMParserSupportedType</dfn> {
<li>
<p>Let <var>document</var> be a new <code>Document</code>, whose <span
data-x="concept-document-content-type">content type</span> is <var>type</var> and <span
data-x="concept-document-URL">url</span> is this's <span>relevant global object</span>'s <span
data-x="concept-document-URL">URL</span> is this's <span>relevant global object</span>'s <span
data-x="concept-document-window">associated <code>Document</code></span>'s <span
data-x="concept-document-URL">URL</span>.</p>
<!-- When https://github.com/whatwg/html/issues/4792 gets fixed we need to investigate which of
Expand All @@ -109136,23 +109140,8 @@ enum <dfn enum>DOMParserSupportedType</dfn> {
data-x="dom-DOMParserSupportedType-texthtml"><code>text/html</code>"</dfn></dt>
<dd>
<ol>
<li><p>Set <var>document</var>'s <span data-x="concept-document-type">type</span> to "<code
data-x="">html</code>".</p></li>

<li><p>Create an <span>HTML parser</span> <var>parser</var>, associated with
<var>document</var>.</p></li>

<li><p>Place <var>string</var> into the <span>input stream</span> for <var>parser</var>. The
encoding <span data-x="concept-encoding-confidence">confidence</span> is
<i>irrelevant</i>.</p></li>

<li>
<p>Start <var>parser</var> and let it run until it has consumed all the characters just
inserted into the input stream.</p>

<p class="note">This might mutate the document's <span
data-x="concept-document-mode">mode</span>.</p>
</li>
<li><p><span>Parse HTML from a string</span> given <var>document</var> and
<var>string</var>.</p></li>
</ol>

<p class="note">Since <var>document</var> does not have a <span
josepharhar marked this conversation as resolved.
Show resolved Hide resolved
Expand Down Expand Up @@ -109194,8 +109183,122 @@ enum <dfn enum>DOMParserSupportedType</dfn> {
<li><p>Return <var>document</var>.</p>
</ol>

<p>To <dfn>parse HTML from a string</dfn>, given a <var>document</var> <code>Document</code> and a
<span>string</span> <var>html</var>:</p>

<ol>
<li><p>Set <var>document</var>'s <span data-x="concept-document-type">type</span> to "<code
data-x="">html</code>".</p></li>

<li><p>Create an <span>HTML parser</span> <var>parser</var>, associated with
<var>document</var>.</p></li>

<li><p>Place <var>html</var> into the <span>input stream</span> for <var>parser</var>. The
encoding <span data-x="concept-encoding-confidence">confidence</span> is
<i>irrelevant</i>.</p></li>

<li>
<p>Start <var>parser</var> and let it run until it has consumed all the characters just
inserted into the input stream.</p>

<p class="note">This might mutate the document's <span
data-x="concept-document-mode">mode</span>.</p>
</li>
</ol>

</div>

<h4>Unsafe HTML parsing methods</h4>

<dl class="domintro">
<dt><code data-x=""><var>element</var>.<span subdfn
data-x="dom-Element-setHTMLUnsafe">setHTMLUnsafe</span>(<var>html</var>)</code></dt>

<dd>
<p>Parses <var>html</var> using the HTML parser, and replaces the children of
<var>element</var> with the result.</p>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved
</dd>

<dt><code data-x=""><var>shadowRoot</var>.<span subdfn
data-x="dom-ShadowRoot-setHTMLUnsafe">setHTMLUnsafe</span>(<var>html</var>)</code></dt>

<dd>
<p>Parses <var>html</var> using the HTML parser, and replaces the children of
<var>shadowRoot</var> with the result.</p>
</dd>

<dt><code data-x=""><var>doc</var> = Document.<span
data-x="dom-parseHTMLUnsafe">parseHTMLUnsafe</span>(<var>html</var>)</code></dt>

<dd>
<p>Parses <var>html</var> using the HTML parser, and returns the resulting
<code>Document</code>.</p>
</dd>
</dl>

<p class="note">These methods perform no sanitization to remove potentially-dangerous elements and
attributes like <code>script</code> or <span>event handler content attributes</span>.</p>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

<pre><code class="idl">partial interface <span id="Element-partial">Element</span> {
undefined <span data-x="dom-Element-setHTMLUnsafe">setHTMLUnsafe</span>(DOMString html);
};</code></pre>

<p><code>Element</code>'s <dfn method for="Element"><code
data-x="dom-Element-setHTMLUnsafe">setHTMLUnsafe(<var>html</var>)</code></dfn> method steps
are:</p>

<ol>
<li><p>Let <var>target</var> be <span>this</span>'s <span>template contents</span> if
<span>this</span> is a <code>template</code> element, otherwise <span>this</span>.</p></li>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

<li><p>Run the <span>unsafe set HTML</span> steps given <var>target</var>, <span>this</span>, and
<var>html</var>.</p></li>
</ol>

<p><cite>DOM</cite> defines the <code>ShadowRoot</code> interface, which this specification
extends.</p>

<pre><code class="idl">partial interface <span id="ShadowRoot-partial">ShadowRoot</span> {
undefined <span data-x="dom-ShadowRoot-setHTMLUnsafe">setHTMLUnsafe</span>(DOMString html);
};</code></pre>

<p><code>ShadowRoot</code>'s <dfn method for="ShadowRoot"><code
data-x="dom-ShadowRoot-setHTMLUnsafe">setHTMLUnsafe(<var>html</var>)</code></dfn> method steps
are to run the <span>unsafe set HTML</span> steps given <span>this</span>, <span>this</span>'s
<span>shadow host</span>, and <var>html</var>.</p>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

<p>To <dfn>unsafe set HTML</dfn>, given an <code>Element</code> <code>ShadowRoot</code>, or
domenic marked this conversation as resolved.
Show resolved Hide resolved
<code>DocumentFragment</code> <var>target</var>, an <code>Element</code>
<var>contextElement</var>, and a <span>string</span> <var>html</var>:</p>

<ol>
<li><p>Let <var>newChildren</var> be the result of the <span>HTML fragment parsing algorithm</span>
given <var>contextElement</var> and <var>html</var>.</p></li>

<li><p>Let <var>fragment</var> be a new <code>DocumentFragment</code> whose <span>node
document</span> is <var>contextElement</var>'s <span>node document</span>.</p></li>

<li><p>For each <var>node</var> in <var>newChildren</var>, <span
data-x="concept-node-append">append</span> <var>node</var> to <var>fragment</var>.</p></li>

<li><p><span data-x="concept-node-replace-all">Replace all</span> with <var>fragment</var> within
<var>target</var>.</p></li>
</ol>

<p>The static <dfn method for="Document"><code
data-x="dom-parseHTMLUnsafe">parseHTMLUnsafe(<var>html</var>)</code></dfn> method steps are:</p>

<ol>
<li><p>Let <var>document</var> be a new <code>Document</code>, whose <span
data-x="concept-document-content-type">content type</span> is "<code
data-x="">text/html</code>".</p></li>
annevk marked this conversation as resolved.
Show resolved Hide resolved

<li><p><span>Parse HTML from a string</span> given <var>document</var> and
<var>html</var>.</p></li>

<li><p>Return <var>document</var>.</p></li>
</ol>


<h3 split-filename="timers-and-user-prompts" id="timers">Timers</h3>

Expand Down