Upstream sanitizer api by noamr · Pull Request #12395 · whatwg/html

noamr · 2026-04-21T13:16:44Z

Convert the incubated spec in https://wicg.github.io/sanitizer-api/ to the HTML format and make it part of the HTML standard.

At least two implementers are interested (and none opposed):
- Gecko/Chromium already shipping
Tests are written and can be reviewed and commented upon at:
- Remove "tentative" from sanitizer API tests. web-platform-tests/wpt#59400
Implementation bugs are filed:
- Chromium: already supported
- Gecko: already supported
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=303808
Corresponding HTML AAM & ARIA in HTML issues & PRs: N/A
MDN issue is filed: already there: https://developer.mozilla.org/en-US/docs/Web/API/Sanitizer
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/canvas.html ( diff )
/comms.html ( diff )
/dom.html ( diff )
/dynamic-markup-insertion.html ( diff )
/edits.html ( diff )
/embedded-content-other.html ( diff )
/form-elements.html ( diff )
/forms.html ( diff )
/grouping-content.html ( diff )
/iframe-embed-object.html ( diff )
/image-maps.html ( diff )
/imagebitmap-and-animations.html ( diff )
/index.html ( diff )
/indices.html ( diff )
/infrastructure.html ( diff )
/interaction.html ( diff )
/interactive-elements.html ( diff )
/microdata.html ( diff )
/parsing.html ( diff )
/references.html ( diff )
/rendering.html ( diff )
/sections.html ( diff )
/semantics.html ( diff )
/system-state.html ( diff )
/tables.html ( diff )
/text-level-semantics.html ( diff )
/timers-and-user-prompts.html ( diff )
/web-messaging.html ( diff )
/webstorage.html ( diff )
/workers.html ( diff )

noamr · 2026-04-21T20:11:47Z

@zcorpan @evilpie @mozfreddyb @otherdaniel
initial review? :)
this is quite a big PR...

evilpie · 2026-04-22T10:07:01Z

Amazing, thanks for working on this.

The built-in safe default configuration is pretty integral to the API, where did I go?

For anyone else looking at this, the gist of the changes are in dynamic-markup-insertion.html.

noamr · 2026-04-22T10:26:27Z

Amazing, thanks for working on this.

The built-in safe default configuration is pretty integral to the API, where did I go?

Oh you're right I had it on my todo list and forgot. Getting to it. Thanks!

noamr · 2026-04-22T10:54:17Z

Amazing, thanks for working on this.
The built-in safe default configuration is pretty integral to the API, where did I go?

Oh you're right I had it on my todo list and forgot. Getting to it. Thanks!

Done.

annevk · 2026-04-22T20:43:22Z

I thought as part of moving this into the HTML standard we'd also address the parser integration issue?

noamr · 2026-04-23T07:33:37Z

I thought as part of moving this into the HTML standard we'd also address the parser integration issue?

This is a huge PR so I thought doing it in two stages, the first one being a purely technical upstream, would be easier to review?

Open and happy to incorporate the stream-while-parsing changes in this PR if you and @zcorpan are ok to review that in one go.

noamr · 2026-04-23T07:58:32Z

@zcorpan @annevk can we align on whether we upstream the sanitizer as is and then change it to stream-while-parsing, or do it in one go? I'm perfectly happy with both options.

zcorpan · 2026-04-23T08:59:38Z

I prefer doing the parser integration in a follow-up PR.

evilpie · 2026-04-23T11:29:55Z

I think these three PRs would be good to merge before merging into the HTML standard:

noamr · 2026-04-23T12:16:00Z

I think these three PRs would be good to merge before merging into the HTML standard:

Remove custom element state when is attribute is blocked WICG/sanitizer-api#396

Clarify condition by splitting it up into explicitly named bools. WICG/sanitizer-api#385

Replace replace all with steps from replaceWith. WICG/sanitizer-api#375

Since some security sensitive changes rely on "sanitizing while parsing", and that in turn relies on the current post-processing sanitizer being upstreamed, I don't think we should delay upstreaming any further.

Can we race it? If any of these go in before the upstream PR is in I'll incorporate them into the HTML PR.

noamr · 2026-04-28T08:34:51Z

+  data-x="dom-SanitizerProcessingInstruction-target">target</code> member.</p>
+  </div>
+
+  <div algorithm>


These algorithms look like they belong in infra... would people be open to adding an optional comparator predicate to those, or to the definition of list/order set?

@annevk @zcorpan

otherdaniel

Thank you, and I'm super happy to see this happening!

I wonder if we can link to the "Security Considerations" section in the current spec; or have them in a supplementary document somewhere?

otherdaniel

Thank you, and I'm super happy to see this happening!

I wonder if we can link to the "Security Considerations" section in the current spec; or have them in a supplementary document somewhere?

See WICG/sanitizer-api#291

noamr · 2026-04-28T13:22:15Z

Thank you, and I'm super happy to see this happening!

I wonder if we can link to the "Security Considerations" section in the current spec; or have them in a supplementary document somewhere?

I've upstreamed them instead into a security consideration subsection

annevk · 2026-04-28T17:49:18Z

   <li><p>Return <var>document</var>.</p></li>
  </ol>
  </div>

  </div>

+  <!-- https://github.com/WICG/sanitizer-api/commit/c4e328037ab6cd9c753b12694f5dcfc14988dec5 -->
+
+  <h4>Safe HTML parsing methods</h4>


I don't think we should use "Safe". Just "HTML parsing methods" is fine. For the same reason we don't say "safe" in APIs.

Moved them together with the "unsafe" methods and explained the difference.

annevk · 2026-04-28T17:51:11Z

+  into an element's <code data-x="dom-Element-innerHTML">innerHTML</code> is fraught with risk, as
+  it can cause script execution in a number of unexpected ways.</p>
+
+  <p>Libraries like <cite>DOMPurify</cite> attempt to manage this problem by carefully parsing and


I think we should trim a bunch of this text. This is a standard, not a justification for the existence of this feature. We also can't assume familiarity with libraries so it's best to just not mention them.

Trimmed considerably

annevk · 2026-04-28T17:53:50Z

+   </li>
+  </ul>
+
+  <h4>Processing model</h4>


This section appears to define API. "Processing model" is generally reserved for something more abstract.

annevk · 2026-04-28T17:55:11Z

+   }</p></li>
+  </ul>
+
+  <h4 id="sanitizer-security-considerations">Security Considerations</h4>


A lot of the headings here don't appear to follow our title case convention.

noamr · 2026-04-30T12:25:29Z

I've refactored some of the sanitization constants to go into each element's definition instead of being in one huge table. I think that makes it less error prone when we add new elements in the future. If that's undesirable I'm happy to revert.

noamr marked this pull request as draft April 21, 2026 13:16

noamr changed the base branch from zcorpan/upstream-sanitizer-api to main April 21, 2026 13:17

noamr changed the title ~~WIP upstream sanitizer api~~ Upstream sanitizer api Apr 21, 2026

noamr force-pushed the zcorpan/upstream-sanitizer-api branch from 223a4d1 to d2034e5 Compare April 21, 2026 19:42

zcorpan reviewed Apr 22, 2026

View reviewed changes

Comment thread source

Comment thread source Outdated

noamr marked this pull request as ready for review April 22, 2026 10:56

zcorpan reviewed Apr 22, 2026

View reviewed changes

Comment thread source Outdated

noamr added the agenda+ To be discussed at a triage meeting label Apr 23, 2026

evilpie reviewed Apr 23, 2026

View reviewed changes

Comment thread source

noamr removed the agenda+ To be discussed at a triage meeting label Apr 23, 2026

noamr closed this Apr 23, 2026

noamr reopened this Apr 23, 2026

noamr commented Apr 28, 2026

View reviewed changes

otherdaniel reviewed Apr 28, 2026

View reviewed changes

Comment thread source

Comment thread source Outdated

Comment thread source Outdated

otherdaniel reviewed Apr 28, 2026

View reviewed changes

zcorpan and others added 5 commits April 28, 2026 14:06

Upstream the Sanitizer API

5ea6f36

See WICG/sanitizer-api#291

Fix build errors, update steps for setHTMLUnsafe

c1c91d0

upstream everything

9a0a7b4

Upstream sanitizer

5747e44

Remove TODO

09f5263

noamr added 20 commits April 28, 2026 14:06

stuff

fd3153a

stuff

d99ffee

use correct algos for PIs

1e5346a

fix refs

fa4dcc3

specfmt

20a3c34

domintro

d56f519

specfmt

aec3faa

nits

272087b

Include built-ins

cc85dec

Add intro h

0e2144f

Use JSON also for the other built-ins

5112500

Use linked tables instead of json

f40b92a

refs

65cf74c

nits

a4cc0fb

nits

bfa078f

Cleanup algorithms

75524bf

Clean up algos

6e2ec7d

Clean up algos

ce6c325

nits

b53cce1

nits

1e065df

noamr force-pushed the zcorpan/upstream-sanitizer-api branch from ea79a5b to 1e065df Compare April 28, 2026 13:07

noamr added 2 commits April 28, 2026 14:13

secpriv

4679acf

Add mXSS biblio

5ab858d

annevk reviewed Apr 28, 2026

View reviewed changes

noamr added 4 commits April 29, 2026 09:58

wip

a34855f

Reduce intro

c65636d

Refer to event handlers table

798a868

Explode sanitization constants into elements for HTML

43519ba

Conversation

noamr commented Apr 21, 2026 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Apr 21, 2026

Uh oh!

evilpie commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Apr 22, 2026

Uh oh!

Uh oh!

Uh oh!

noamr commented Apr 22, 2026

Uh oh!

Uh oh!

annevk commented Apr 22, 2026

Uh oh!

noamr commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zcorpan commented Apr 23, 2026

Uh oh!

Uh oh!

evilpie commented Apr 23, 2026

Uh oh!

noamr commented Apr 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

otherdaniel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

otherdaniel left a comment

Choose a reason for hiding this comment

Uh oh!

noamr commented Apr 28, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

noamr Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

noamr commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

noamr commented Apr 21, 2026 •

edited by pr-preview Bot

Loading

evilpie commented Apr 22, 2026 •

edited

Loading

noamr commented Apr 23, 2026 •

edited

Loading

noamr commented Apr 23, 2026 •

edited

Loading

noamr Apr 29, 2026 •

edited

Loading

noamr commented Apr 30, 2026 •

edited

Loading