Add streamHTMLUnsafe() methods #11631
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -4611,6 +4611,17 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute | |||||
| </ul> | ||||||
| </dd> | ||||||
|
|
||||||
| <dt>Streams</dt> | ||||||
| <dd> | ||||||
| <p>The following terms are defined in <cite>Streams</cite>: <ref>STREAMS</ref></p> | ||||||
|
|
||||||
| <ul class="brief"> | ||||||
| <li><dfn data-x-href="https://streams.spec.whatwg.org/#writablestream"><code>WritableStream</code></dfn></li> | ||||||
| <li><dfn data-x-href="https://streams.spec.whatwg.org/#writablestream-set-up" for="WritableStream">set up</dfn> a newly-<span data-x="new">created-via-Web IDL</span> <code>WritableStream</code></li> | ||||||
| <li><dfn data-x-href="https://streams.spec.whatwg.org/#abort-a-writable-stream" for="WritableStream">abort</dfn> a <code>WritableStream</code></li> | ||||||
| </ul> | ||||||
| </dd> | ||||||
|
|
||||||
| <dt>Web App Manifest</dt> | ||||||
|
|
||||||
| <dd> | ||||||
|
|
@@ -4791,6 +4802,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute | |||||
| <li><dfn data-x="tt-trustedscript-data" data-x-href="https://w3c.github.io/trusted-types/dist/spec/#trustedscript-data"><code>data</code></dfn></li> | ||||||
| <li><dfn data-x="tt-trustedscripturl" data-x-href="https://w3c.github.io/trusted-types/dist/spec/#trustedscripturl"><code>TrustedScriptURL</code></dfn></li> | ||||||
| <li><dfn data-x="tt-getcompliantstring" data-x-href="https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-compliant-string">get trusted type compliant string</dfn></li> | ||||||
| <li><dfn data-x="tt-shouldblock" data-x-href="https://w3c.github.io/trusted-types/dist/spec/#should-sink-type-mismatch-violation-be-blocked-by-content-security-policy">should sink type mismatch violation be blocked by content security policy?</dfn></li> | ||||||
| </ul> | ||||||
| </dd> | ||||||
|
|
||||||
|
|
@@ -123517,22 +123529,26 @@ document.body.appendChild(frame)</code></pre> | |||||
|
|
||||||
| <h3 id="dom-parsing-and-serialization">DOM parsing and serialization APIs</h3> | ||||||
|
|
||||||
| <pre><code class="idl">partial interface <span>Element</span> { | ||||||
| [<span>CEReactions</span>] undefined <span data-x="dom-Element-setHTMLUnsafe">setHTMLUnsafe</span>((<code data-x="tt-trustedhtml">TrustedHTML</code> or DOMString) html, optional <span>SetHTMLUnsafeOptions</span> options = {}); | ||||||
| DOMString <span data-x="dom-Element-getHTML">getHTML</span>(optional <span>GetHTMLOptions</span> options = {}); | ||||||
|
|
||||||
| [<span>CEReactions</span>] attribute (<code data-x="tt-trustedhtml">TrustedHTML</code> or [<span>LegacyNullToEmptyString</span>] DOMString) <span data-x="dom-Element-innerHTML">innerHTML</span>; | ||||||
| [<span>CEReactions</span>] attribute (<code data-x="tt-trustedhtml">TrustedHTML</code> or [<span>LegacyNullToEmptyString</span>] DOMString) <span data-x="dom-Element-outerHTML">outerHTML</span>; | ||||||
| [<span>CEReactions</span>] undefined <span data-x="dom-Element-insertAdjacentHTML">insertAdjacentHTML</span>(DOMString position, (<code data-x="tt-trustedhtml">TrustedHTML</code> or DOMString) string); | ||||||
| }; | ||||||
|
|
||||||
| partial interface <span>ShadowRoot</span> { | ||||||
| [<span>CEReactions</span>] undefined <span data-x="dom-ShadowRoot-setHTMLUnsafe">setHTMLUnsafe</span>((<code data-x="tt-trustedhtml">TrustedHTML</code> or DOMString) html, optional <span>SetHTMLUnsafeOptions</span> options = {}); | ||||||
| DOMString <span data-x="dom-ShadowRoot-getHTML">getHTML</span>(optional <span>GetHTMLOptions</span> options = {}); | ||||||
|
|
||||||
| [<span>CEReactions</span>] attribute (<code data-x="tt-trustedhtml">TrustedHTML</code> or [<span>LegacyNullToEmptyString</span>] DOMString) <span data-x="dom-ShadowRoot-innerHTML">innerHTML</span>; | ||||||
| }; | ||||||
|
|
||||||
| dictionary <dfn dictionary>SetHTMLUnsafeOptions</dfn> { | ||||||
| boolean <dfn dict-member for="SetHTMLUnsafeOptions" data-x="dom-SetHTMLUnsafeOptions-runScripts">runScripts</dfn> = false; | ||||||
| }; | ||||||
|
|
||||||
| dictionary <dfn dictionary>GetHTMLOptions</dfn> { | ||||||
| boolean <dfn dict-member for="GetHTMLOptions" data-x="dom-GetHTMLOptions-serializableShadowRoots">serializableShadowRoots</dfn> = false; | ||||||
| sequence<ShadowRoot> <dfn dict-member for="GetHTMLOptions" data-x="dom-GetHTMLOptions-shadowRoots">shadowRoots</dfn> = []; | ||||||
|
|
@@ -123710,20 +123726,27 @@ enum <dfn enum>DOMParserSupportedType</dfn> { | |||||
|
|
||||||
| <dl class="domintro"> | ||||||
| <dt><code data-x=""><var>element</var>.<span subdfn | ||||||
| data-x="dom-Element-setHTMLUnsafe">setHTMLUnsafe</span>(<var>html</var>, <var>options</var>)</code></dt> | ||||||
|
|
||||||
| <dd> | ||||||
| <p>Parses <var>html</var> using the HTML parser, and replaces the children of <var>element</var> | ||||||
| with the result. <var>element</var> provides context for the HTML parser. <var>options</var> | ||||||
| can contain the following values:</p> | ||||||
|
|
||||||
| <ul> | ||||||
| <li><p><code data-x="dom-SetHTMLUnsafeOptions-runScripts">runScripts</code> can be set to true | ||||||
| to run scripts when they are inserted into the document.</p></li> | ||||||
| </ul> | ||||||
| </dd> | ||||||
|
|
||||||
| <dt><code data-x=""><var>shadowRoot</var>.<span subdfn | ||||||
| data-x="dom-ShadowRoot-setHTMLUnsafe">setHTMLUnsafe</span>(<var>html</var>, <var>options</var>)</code></dt> | ||||||
|
|
||||||
| <dd> | ||||||
| <p>Parses <var>html</var> using the HTML parser, and replaces the children of | ||||||
| <var>shadowRoot</var> with the result. <var>shadowRoot</var>'s <span | ||||||
| data-x="concept-DocumentFragment-host">host</span> provides context for the HTML parser. | ||||||
| <var>options</var> has the same values as above.</p> | ||||||
| </dd> | ||||||
|
|
||||||
| <dt><code data-x=""><var>doc</var> = Document.<span | ||||||
|
|
@@ -123747,8 +123770,8 @@ enum <dfn enum>DOMParserSupportedType</dfn> { | |||||
|
|
||||||
| <div algorithm> | ||||||
| <p><code>Element</code>'s <dfn method for="Element"><code | ||||||
| data-x="dom-Element-setHTMLUnsafe">setHTMLUnsafe(<var>html</var>, <var>options</var>)</code></dfn> | ||||||
| method steps are:</p> | ||||||
|
|
||||||
| <ol> | ||||||
| <li><p>Let <var>compliantHTML</var> be the result of invoking the <span | ||||||
|
|
@@ -123760,15 +123783,15 @@ enum <dfn enum>DOMParserSupportedType</dfn> { | |||||
| <li><p>Let <var>target</var> be <span>this</span>'s <span>template contents</span> if | ||||||
| <span>this</span> is a <code>template</code> element; otherwise <span>this</span>.</p></li> | ||||||
|
|
||||||
| <li><p><span>Unsafely set HTML</span> given <var>target</var>, <span>this</span>, | ||||||
| <var>compliantHTML</var>, and <var>options</var>.</p></li> | ||||||
| </ol> | ||||||
| </div> | ||||||
|
|
||||||
| <div algorithm> | ||||||
| <p><code>ShadowRoot</code>'s <dfn method for="ShadowRoot"><code | ||||||
| data-x="dom-ShadowRoot-setHTMLUnsafe">setHTMLUnsafe(<var>html</var>, | ||||||
| <var>options</var>)</code></dfn> method steps are:</p> | ||||||
|
|
||||||
| <ol> | ||||||
| <li><p>Let <var>compliantHTML</var> be the result of invoking the <span | ||||||
|
|
@@ -123778,14 +123801,15 @@ enum <dfn enum>DOMParserSupportedType</dfn> { | |||||
| data-x="">script</code>".</p></li> | ||||||
|
|
||||||
| <li><p><span>Unsafely set HTML</span> given <span>this</span>, <span>this</span>'s <span | ||||||
| data-x="concept-DocumentFragment-host">shadow host</span>, <var>compliantHTML</var>, | ||||||
| and <var>options</var>.</p></li> | ||||||
| </ol> | ||||||
| </div> | ||||||
|
|
||||||
| <div algorithm> | ||||||
| <p>To <dfn>unsafely set HTML</dfn>, given an <code>Element</code> or <code>DocumentFragment</code> | ||||||
| <var>target</var>, an <code>Element</code> <var>contextElement</var>, a <span>string</span> | ||||||
| <var>html</var>, and <var>options</var>:</p> | ||||||
|
|
||||||
| <ol> | ||||||
| <li><p>Let <var>newChildren</var> be the result of the <span>HTML fragment parsing | ||||||
|
|
@@ -123797,6 +123821,15 @@ enum <dfn enum>DOMParserSupportedType</dfn> { | |||||
| <li><p>For each <var>node</var> in <var>newChildren</var>, <span | ||||||
| data-x="concept-node-append">append</span> <var>node</var> to <var>fragment</var>.</p></li> | ||||||
|
|
||||||
| <li> | ||||||
| <p>If <var>options</var>["<code data-x="dom-SetHTMLUnsafeOptions-runScripts">runScripts</code>"] | ||||||
| is true, set <span>already started</span> to false for all <code>script</code> element | ||||||
| shadow-including descendant of <var>fragment</var>.</p> | ||||||
|
|
||||||
| <p class="XXX">Do this in the parser by not setting <span>already started</span> to true in the | ||||||
| first place.</p> | ||||||
| </li> | ||||||
|
|
||||||
| <li><p><span data-x="concept-node-replace-all">Replace all</span> with <var>fragment</var> within | ||||||
| <var>target</var>.</p></li> | ||||||
| </ol> | ||||||
|
|
@@ -124396,6 +124429,155 @@ interface <dfn interface>XMLSerializer</dfn> { | |||||
|
|
||||||
| </div> | ||||||
|
|
||||||
|
|
||||||
| <h4>The <code data-x="dom-Element-streamHTMLUnsafe">streamHTMLUnsafe()</code> method</h4> | ||||||
|
|
||||||
| <dl class="domintro"> | ||||||
| <dt><code data-x=""><var>element</var>.<span subdfn | ||||||
| data-x="dom-Element-streamHTMLUnsafe">streamHTMLUnsafe</span>(<var>options</var>)</code></dt> | ||||||
|
|
||||||
| <dd> | ||||||
| <p>Returns a writable stream that acts as the input stream of an HTML parser. <var>options</var> | ||||||
| can contain the following values:</p> | ||||||
|
|
||||||
| <ul> | ||||||
| <li><p><code data-x="dom-SetHTMLUnsafeOptions-runScripts">runScripts</code> can be set to true | ||||||
| to run scripts when they are inserted into the document.</p></li> | ||||||
| </ul> | ||||||
|
|
||||||
| <p>Existing children of <var>element</var> are removed and new nodes are added as they are | ||||||
| produced by the parser.</p> | ||||||
| </dd> | ||||||
|
|
||||||
| <dt><code data-x=""><var>shadowRoot</var>.<span subdfn | ||||||
| data-x="dom-ShadowRoot-streamHTMLUnsafe">streamHTMLUnsafe</span>(<var>options</var>)</code></dt> | ||||||
|
|
||||||
| <dd> | ||||||
| <p>Returns a writable stream that acts as the input stream of an HTML parser. <var>options</var> | ||||||
| has the same values as above. Existing children of <var>shadowRoot</var> are removed and new | ||||||
| nodes are added as they are produced by the parser.</p> | ||||||
| </dd> | ||||||
| </dl> | ||||||
|
|
||||||
| <p class="warning">These methods perform no sanitization to remove potentially-dangerous elements | ||||||
| and attributes like <code>script</code> or <span>event handler content attributes</span>.</p> | ||||||
|
|
||||||
| <div w-nodev> | ||||||
|
|
||||||
| <pre><code class="idl">partial interface <span>Element</span> { | ||||||
| WritableStream <span data-x="dom-Element-streamHTMLUnsafe">streamHTMLUnsafe</span>(optional <span>SetHTMLUnsafeOptions</span> options = {}); | ||||||
| }; | ||||||
|
|
||||||
| partial interface <span>ShadowRoot</span> { | ||||||
| WritableStream <span data-x="dom-ShadowRoot-streamHTMLUnsafe">streamHTMLUnsafe</span>(optional <span>SetHTMLUnsafeOptions</span> options = {}); | ||||||
| };</code></pre> | ||||||
|
|
||||||
| <div algorithm> | ||||||
| <p><code>Element</code>'s <dfn method for="Element"><code | ||||||
| data-x="dom-Element-streamHTMLUnsafe">streamHTMLUnsafe(<var>options</var>)</code></dfn> method steps | ||||||
| are:</p> | ||||||
|
|
||||||
| <ol> | ||||||
| <li><p>If <var>this</var>'s <span>node document</span> is an <span data-x="XML documents">XML | ||||||
| document</span>, then throw an <span>"<code>InvalidStateError</code>"</span> | ||||||
| <code>DOMException</code>.</p></li> | ||||||
|
|
||||||
| <li><p>Let <var>disposition</var> be the result of invoking the <span | ||||||
| data-x="tt-shouldblock">should sink type mismatch violation be blocked by content security | ||||||
| policy?</span> algorithm given <span>this</span>'s <span>relevant global object</span>, | ||||||
| "<code data-x="">Element streamHTMLUnsafe</code>", "<code data-x="">script</code>", and | ||||||
| "".</p></li> | ||||||
|
|
||||||
| <li><p>If <var>disposition</var> is not "<code data-x="">Allowed</code>", then throw a | ||||||
| <code>TypeError</code> exception.</p></li> | ||||||
|
|
||||||
| <li><p>Let <var>target</var> be <span>this</span>'s <span>template contents</span> if | ||||||
| <span>this</span> is a <code>template</code> element; otherwise <span>this</span>.</p></li> | ||||||
|
|
||||||
| <li><p>Return the result of <span>unsafely stream HTML</span> given <var>target</var>, | ||||||
| <span>this</span>, and <var>options</var>.</p></li> | ||||||
| </ol> | ||||||
| </div> | ||||||
|
|
||||||
| <div algorithm> | ||||||
| <p><code>ShadowRoot</code>'s <dfn method for="ShadowRoot"><code | ||||||
| data-x="dom-ShadowRoot-streamHTMLUnsafe">streamHTMLUnsafe(<var>options</var>)</code></dfn> method steps | ||||||
| are:</p> | ||||||
|
|
||||||
| <ol> | ||||||
| <li><p>If <var>this</var>'s <span>node document</span> is an <span data-x="XML documents">XML | ||||||
| document</span>, then throw an <span>"<code>InvalidStateError</code>"</span> | ||||||
| <code>DOMException</code>.</p></li> | ||||||
|
|
||||||
| <li><p>Let <var>disposition</var> be the result of invoking the <span | ||||||
| data-x="tt-shouldblock">should sink type mismatch violation be blocked by content security | ||||||
| policy?</span> algorithm given <span>this</span>'s <span>relevant global object</span>, | ||||||
| "<code data-x="">ShadowRoot streamHTMLUnsafe</code>", "<code data-x="">script</code>", and | ||||||
|
||||||
| "".</p></li> | ||||||
|
|
||||||
|
|
||||||
|
||||||
| <li> <p>Let <var>parser</var> be an <span>HTML parser</span> using the <span>streaming HTML | |
| <li><p>Let <var>parser</var> be an <span>HTML parser</span> using the <span>streaming HTML |
Outdated
Member
There was a problem hiding this comment.
Given that a lot of the complexity is here, I was hoping this would have been a bit more flushed out before the stage 2 request. The overall API shape seems fine, but I feel like as we're discussing this feature we keep discovering new issues with the supposedly "straightforward" HTML parser integration and we still don't quite know what that is going to look like.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Use
<code>for string contents.