Ability to configure whether script elements should execute for setHTMLUnsafe()

[zcorpan]

What is the issue with the HTML Standard?

Currently innerHTML and insertContextualFragment() will not execute script elements because:

https://html.spec.whatwg.org/#script-processing-model:already-started-4 sets "already started" to true when the element is inserted into the temporary document during fragment parsing, and step 17 returns because scripting is disabled for that document. Then when the elements are inserted into the right place, "already started" is still true and https://html.spec.whatwg.org/#script-processing-model:already-started-3 returns.

Range.createContextualFragment() unsets the "already started" flag and therefore runs scripts: https://w3c.github.io/DOM-Parsing/#dom-range-createcontextualfragment (step 4).

In a previous meeting for Sanitizer API, we discussed this for setHTMLUnsafe() and the group's general agreement was that we should align with innerHTML by default but in the future we can allow a config to make script elements execute.

(This was originally filed at WICG/sanitizer-api#195 )

cc @whatwg/html-parser @mozfreddyb