From 8ec596cf2db84714711cd3a7c3db4efc3e54eb1f Mon Sep 17 00:00:00 2001 From: Joey Arhar Date: Tue, 18 Jul 2023 19:59:41 -0700 Subject: [PATCH 01/25] Add setHTMLUnsafe and parseHTMLUnsafe methods Based on this: https://github.com/otherdaniel/purification/blob/explainer-examples/explainer.md#examples --- source | 95 +++++++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 78 insertions(+), 17 deletions(-) diff --git a/source b/source index be9f621d529..acb0553c836 100644 --- a/source +++ b/source @@ -3309,6 +3309,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute

The following features are defined in Selection API:

@@ -104502,23 +104503,8 @@ enum DOMParserSupportedType { data-x="dom-DOMParserSupportedType-texthtml">text/html"
    -

  1. Set document's type to "html".

    2. - -

  2. Create an HTML parser parser, associated with - document.

    3. - -

  3. Place string into the input stream for parser. The - encoding confidence is - irrelevant.

    4. - -
  4. -

    Start parser and let it run until it has consumed all the characters just - inserted into the input stream.

    - -

    This might mutate the document's mode.

    -
    5. +

  5. Parse HTML from a string given document and + string.

Since document does not have a DOMParserSupportedType {

  • Return document.

    +

    To parse HTML from a string, given a document Document and a + string string:

    + +
      +

    1. Set document's type to "html".

      2. + +

    2. Create an HTML parser parser, associated with + document.

      3. + +

    3. Place string into the input stream for parser. The + encoding confidence is + irrelevant.

      4. + +
    4. +

      Start parser and let it run until it has consumed all the characters just + inserted into the input stream.

      + +

      This might mutate the document's mode.

      +
      5. +
    + +

    Element.setHTMLUnsafe

    + +

    Element.setHTMLUnsafe allows authors to create new + Document objects by parsing strings, as either HTML for XML. Unlike + DOMParser, it allows the usage of declarative shadowdom...? TODO

    + +

    TODO add "For web developers (non-normative) section

    + +

    The Element.setHTMLUnsafe(string) method steps + are:

    + +
      +

    1. Let contextElement be this's host if this is a + ShadowRoot, otherwise this.

      2. + +

    2. Let fragment be the result of the fragment parsing algorithm given + string and this.

      3. + +

    3. Let target be this's template contents if + this is template, otherwise this.

      4. + +

    4. Replace all given fragment and + target.

      5. +
    + +

    Document.parseHTMLUnsafe

    + +

    TODO add "For web developers (non-normative) section

    + +

    The Document.parseHTMLUnsafe(string) method steps + are:

    + +
      +

    1. TODO: Do documents have a relevant global object this was copied over from the other + algorithm which doesn't seem to have a well specified "this"?

      2. + +

    2. Let document be a new Document, whose content type is text/html and url is this's relevant global + object's associated Document's + URL.

      3. + +

    3. Parse HTML from a string given document and + string.

      4. + +

    4. Return document.

      5. +
    +

    Timers

    From 345c8882343b31ac49bc3d2187b60ffb1a3289a4 Mon Sep 17 00:00:00 2001 From: Joey Arhar Date: Wed, 19 Jul 2023 18:29:48 -0700 Subject: [PATCH 02/25] wrote more stuff --- source | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) diff --git a/source b/source index acb0553c836..b6197afa642 100644 --- a/source +++ b/source @@ -104571,13 +104571,34 @@ enum DOMParserSupportedType { -

    Element.setHTMLUnsafe

    +

    setHTMLUnsafe and parseHTMLUnsafe

    -

    Element.setHTMLUnsafe allows authors to create new - Document objects by parsing strings, as either HTML for XML. Unlike - DOMParser, it allows the usage of declarative shadowdom...? TODO

    +
    +
    element.setHTMLUnsafe(string)
    + +
    +

    Parses string using the HTML parser, and replaces the children of + element with the result.

    +
    -

    TODO add "For web developers (non-normative) section

    +
    doc = document.parseHTMLUnsafe(string)
    + +
    +

    Parses string using the HTML parser, and returns the resulting + Document.

    +
    +
    + + 
    interface Element {
+  undefined setHTMLUnsafe(string);
+};
+
+interface Document {
+  Document parseHTMLUnsafe(string);
+};

    The Element.setHTMLUnsafe(string) method steps @@ -104600,8 +104621,6 @@ enum DOMParserSupportedType {

    Document.parseHTMLUnsafe

    -

    TODO add "For web developers (non-normative) section

    -

    The Document.parseHTMLUnsafe(string) method steps are:

    From 63abb16ff1e9e3dab355e4309c8808118cf4d1fc Mon Sep 17 00:00:00 2001 From: Joey Arhar Date: Wed, 19 Jul 2023 18:41:32 -0700 Subject: [PATCH 03/25] fix idl --- source | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/source b/source index b6197afa642..e21fe1552df 100644 --- a/source +++ b/source @@ -104592,12 +104592,12 @@ enum DOMParserSupportedType {
    • - 
    interface Element {
-  undefined setHTMLUnsafe(string);
+  
    interface Element {
+  undefined setHTMLUnsafe(DOMString string);
 };
 
-interface Document {
-  Document parseHTMLUnsafe(string);
+interface Document {
+  Document parseHTMLUnsafe(DOMString string);
 };
    
 
   
    The 
Date: Thu, 20 Jul 2023 08:49:33 -0700
Subject: [PATCH 04/25] make parsehtmlunsafe static

---
 source | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source b/source
index e21fe1552df..029def4416b 100644
--- a/source
+++ b/source
@@ -104597,7 +104597,7 @@ enum DOMParserSupportedType {
 };
 
 interface Document {
-  Document parseHTMLUnsafe(DOMString string);
+  static Document parseHTMLUnsafe(DOMString string);
 };

    The Date: Tue, 8 Aug 2023 14:25:24 -0700 Subject: [PATCH 05/25] resolve todo --- source | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/source b/source index 029def4416b..cef7b72ef37 100644 --- a/source +++ b/source @@ -104626,15 +104626,11 @@ interface Document { are:

      -

    1. TODO: Do documents have a relevant global object this was copied over from the other - algorithm which doesn't seem to have a well specified "this"?

      2. -

    2. Let document be a new Document, whose content type is text/html and url is this's relevant global - object's associated Document's - URL.

      3. + data-x="concept-document-URL">url is this's URL.

    3. Parse HTML from a string given document and string.

      4. From 3b7e41f409bc2516c88d8b74b2a3fad7c251bf47 Mon Sep 17 00:00:00 2001 From: Joey Arhar Date: Tue, 15 Aug 2023 13:31:11 -0700 Subject: [PATCH 06/25] improve idl --- source | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/source b/source index 5a665b3063b..e72e42020d3 100644 --- a/source +++ b/source @@ -10607,6 +10607,7 @@ partial interface Document { [CEReactions] undefined close(); [CEReactions] undefined write(DOMString... text); [CEReactions] undefined writeln(DOMString... text); + Document parseHTMLUnsafe(string html); // user interaction readonly attribute WindowProxy? defaultView; @@ -109031,12 +109032,8 @@ enum DOMParserSupportedType { - 
      interface Element {
+  
      partial interface Element {
   undefined setHTMLUnsafe(DOMString string);
-};
-
-interface Document {
-  static Document parseHTMLUnsafe(DOMString string);
 };
      
 
   
      The 
Date: Tue, 15 Aug 2023 13:41:38 -0700
Subject: [PATCH 07/25] add domparser heading

---
 source | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/source b/source
index e72e42020d3..8b280b5acca 100644
--- a/source
+++ b/source
@@ -108862,6 +108862,8 @@ document.body.appendChild(frame)
      also live here? -->

      DOM parsing

      +

      The DOMParser interface

      +

      The DOMParser interface allows authors to create new Document objects by parsing strings, as either HTML or XML.

      From cb9917483ab903daba73adc05bbba3afc13fd992 Mon Sep 17 00:00:00 2001 From: Joey Arhar Date: Tue, 15 Aug 2023 13:42:29 -0700 Subject: [PATCH 08/25] typo + static --- source | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source b/source index 8b280b5acca..e6070e81f1c 100644 --- a/source +++ b/source @@ -10607,7 +10607,7 @@ partial interface Document { [CEReactions] undefined close(); [CEReactions] undefined write(DOMString... text); [CEReactions] undefined writeln(DOMString... text); - Document parseHTMLUnsafe(string html); + static Document parseHTMLUnsafe(string html); // user interaction readonly attribute WindowProxy? defaultView; @@ -109025,7 +109025,7 @@ enum DOMParserSupportedType { element with the result.

      -
      doc = document.doc = Document.parseHTMLUnsafe(string)
      From 7a7c1eec6de4e8ca11f29a32b39b4724a80b9b74 Mon Sep 17 00:00:00 2001 From: Joey Arhar Date: Tue, 15 Aug 2023 13:49:46 -0700 Subject: [PATCH 09/25] feedback --- source | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/source b/source index e6070e81f1c..7d686d6d323 100644 --- a/source +++ b/source @@ -109013,8 +109013,7 @@ enum DOMParserSupportedType { -

      setHTMLUnsafe and parseHTMLUnsafe

      +

      Unsafe HTML parsing methods

      element.DOMParserSupportedType {
      +

      These methods perform no sanitization to remove potentially-dangerous elements and + attributes like script or event handler content attributes.

      + 
      partial interface Element {
   undefined setHTMLUnsafe(DOMString string);
 };

      The Element.setHTMLUnsafe(string) method steps - are:

      + data-x="dom-setHTMLUnsafe">setHTMLUnsafe(string)       method steps are:

      1. Let contextElement be this's Date: Tue, 15 Aug 2023 16:30:43 -0700 Subject: [PATCH 10/25] fix fragment parsing reference --- source | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/source b/source index 7d686d6d323..c064700d33f 100644 --- a/source +++ b/source @@ -109048,8 +109048,14 @@ enum DOMParserSupportedType { data-x="concept-DocumentFragment-host">host if this is a ShadowRoot, otherwise this.

        2. -

      2. Let fragment be the result of the fragment parsing algorithm given - string and this.

        3. +

      3. Let newChildren be the result of the HTML fragment parsing algorithm + given this and string.

        4. + +

      4. Let fragment be a new DocumentFragment whose node + document is this's node document.

        5. + +

      5. Append each Node in + newChildren to fragment in tree order.

      6. Let target be this's template contents if this is template, otherwise this.

        7. From 4909dc6f60f560b774d605504af8fcb4ce43235c Mon Sep 17 00:00:00 2001 From: Joey Arhar Date: Tue, 15 Aug 2023 16:41:38 -0700 Subject: [PATCH 11/25] nits --- source | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/source b/source index c064700d33f..131b5424c47 100644 --- a/source +++ b/source @@ -108924,7 +108924,7 @@ enum DOMParserSupportedType {

      7. Let document be a new Document, whose content type is type and url is this's relevant global object's URL is this's relevant global object's associated Document's URL.

        DOM parsing

        -

        The DOMParser interface

        -

        The DOMParser interface allows authors to create new Document objects by parsing strings, as either HTML or XML.

        @@ -109208,8 +109206,6 @@ enum DOMParserSupportedType { -

        Unsafe HTML parsing methods

        -
        element.setHTMLUnsafe(html)
        @@ -109265,11 +109261,11 @@ enum DOMParserSupportedType {

        ShadowRoot's setHTMLUnsafe(html) method steps are to run the unsafe set HTML steps given this, this's - shadow host, and html.

        + shadow host, and html.

        -

        To unsafe set HTML, given an Element ShadowRoot, or - DocumentFragment target, an Element - contextElement, and a string html:

        +

        To unsafe set HTML, given an Element or DocumentFragment + target, an Element contextElement, and a string + html:

        1. Let newChildren be the result of the HTML fragment parsing algorithm From 090d6a89512f1570d63b00eca5bd404f823f69ef Mon Sep 17 00:00:00 2001 From: Joey Arhar Date: Thu, 21 Sep 2023 14:11:12 -0700 Subject: [PATCH 21/25] add scripting note --- source | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/source b/source index ad0c6aa00b5..e70deb6201a 100644 --- a/source +++ b/source @@ -109285,9 +109285,15 @@ enum DOMParserSupportedType { data-x="dom-parseHTMLUnsafe">parseHTMLUnsafe(html) method steps are:

            -

          1. Let document be a new Document, whose content type is "text/html".

            2. +
          2. +

            Let document be a new Document, whose content type is "text/html".

            + +

            Since document does not have a browsing context, scripting + is disabled.

            +

          3. Parse HTML from a string given document and html.

            4. From b6f859cd9aaef075e238657c522c98d071f2462e Mon Sep 17 00:00:00 2001 From: Joey Arhar Date: Thu, 21 Sep 2023 14:19:43 -0700 Subject: [PATCH 22/25] say which element provides context to parser --- source | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/source b/source index e70deb6201a..36282622881 100644 --- a/source +++ b/source @@ -109211,8 +109211,8 @@ enum DOMParserSupportedType { data-x="dom-Element-setHTMLUnsafe">setHTMLUnsafe(html)
            -

            Parses html using the HTML parser, and replaces the children of - element with the result.

            +

            Parses html using the HTML parser, and replaces the children of element + with the result. element provides context for the HTML parser.

            shadowRoot.DOMParserSupportedType {

            Parses html using the HTML parser, and replaces the children of - shadowRoot with the result.

            + shadowRoot with the result. shadowRoot's host provides context for the HTML parser.

            doc = Document. Date: Thu, 21 Sep 2023 14:20:03 -0700 Subject: [PATCH 23/25] note->warning --- source | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source b/source index 36282622881..c83c1fc3f27 100644 --- a/source +++ b/source @@ -109233,8 +109233,8 @@ enum DOMParserSupportedType {
        -

        These methods perform no sanitization to remove potentially-dangerous elements and - attributes like script or event handler content attributes.

        +

        These methods perform no sanitization to remove potentially-dangerous elements + and attributes like script or event handler content attributes.

        partial interface Element {
   undefined setHTMLUnsafe(DOMString html);

From 0c1331e9aea7d1eb34cf569f24043ca13747339c Mon Sep 17 00:00:00 2001
From: Joey Arhar 
Date: Thu, 21 Sep 2023 14:20:40 -0700
Subject: [PATCH 24/25] ,->;

---
 source | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source b/source
index c83c1fc3f27..bee24af9dae 100644
--- a/source
+++ b/source
@@ -109246,7 +109246,7 @@ enum DOMParserSupportedType {
 
   
          
    
        1. Let target be this's template contents if
-   this is a template element, otherwise this.
          2. 
+   this is a template element; otherwise this.
          
 
    
        2. Run the unsafe set HTML steps given target, this, and
    html.
          3. 

From d8e8f2c90ac32ae3175d8402cb0a8ff943ae7709 Mon Sep 17 00:00:00 2001
From: Domenic Denicola 
Date: Tue, 10 Oct 2023 14:17:03 +0900
Subject: [PATCH 25/25] Final touches

---
 source | 44 +++++++++++++++++++++++++++++---------------
 1 file changed, 29 insertions(+), 15 deletions(-)

diff --git a/source b/source
index bee24af9dae..f8aa5389980 100644
--- a/source
+++ b/source
@@ -109057,6 +109057,8 @@ document.body.appendChild(frame)
        also live here? -->

        DOM parsing

        +

        The DOMParser interface

        +

        The DOMParser interface allows authors to create new Document objects by parsing strings, as either HTML or XML.

        @@ -109077,7 +109079,8 @@ document.body.appendChild(frame)

        Note that script elements are not evaluated during parsing, and the resulting document's encoding will always be - UTF-8.

        + UTF-8. The document's URL will be + inherited from parser's relevant global object.

        Values other than the above for type will cause a TypeError exception to be thrown.

        @@ -109085,9 +109088,10 @@ document.body.appendChild(frame)

        The design of DOMParser, as a class that needs to be constructed and - then have its parseFromString() method called, - is an unfortunate historical artifact. If we were designing this functionality today it would be a - standalone function.

        + then have its parseFromString() method + called, is an unfortunate historical artifact. If we were designing this functionality today it + would be a standalone function. For parsing HTML, the modern alternative is Document.parseHTMLUnsafe().

        [Exposed=Window]
 interface DOMParser {
@@ -109206,6 +109210,8 @@ enum DOMParserSupportedType {
 
   
 
+  
        Unsafe HTML parsing methods
        
+
   
        
    
        element.setHTMLUnsafe(html)
        
@@ -109230,6 +109236,11 @@ enum DOMParserSupportedType {
    
        
     
        Parses html using the HTML parser, and returns the resulting
     Document.
        
+
+    
        Note that script elements are not evaluated during parsing, and the resulting
+    document's encoding will always be
+    UTF-8. The document's URL will be
+    about:blank.
        
    
        
   
        
 
@@ -109238,8 +109249,14 @@ enum DOMParserSupportedType {
 
   
        partial interface Element {
   undefined setHTMLUnsafe(DOMString html);
+};
+
+partial interface ShadowRoot {
+  undefined setHTMLUnsafe(DOMString html);
 };
        
 
+  
        
+
   
        Element's setHTMLUnsafe(html) method steps
   are:
        
@@ -109248,23 +109265,16 @@ enum DOMParserSupportedType {
    
      8. Let target be this's template contents if
    this is a template element; otherwise this.
        9. 
 
-   
      9. Run the unsafe set HTML steps given target, this, and
+   
      10. Unsafely set HTML given target, this, and
    html.
        11.
      -

      DOM defines the ShadowRoot interface, which this specification - extends.

      - - 
      partial interface ShadowRoot {
-  undefined setHTMLUnsafe(DOMString html);
-};
      -

      ShadowRoot's setHTMLUnsafe(html) method steps - are to run the unsafe set HTML steps given this, this's - shadow host, and html.

      + are to unsafely set HTML given this, this's shadow host, and html.

      -

      To unsafe set HTML, given an Element or DocumentFragment +

      To unsafely set HTML, given an Element or DocumentFragment target, an Element contextElement, and a string html:

      @@ -109282,6 +109292,8 @@ enum DOMParserSupportedType { target.

    +
    +

    The static parseHTMLUnsafe(html) method steps are:

    @@ -109302,6 +109314,8 @@ enum DOMParserSupportedType {

  • Return document.

    • + +

    Timers