Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add setHTMLUnsafe and parseHTMLUnsafe methods #9538

Merged
merged 27 commits into from Oct 11, 2023
Merged

Add setHTMLUnsafe and parseHTMLUnsafe methods #9538

Changes from 12 commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
8ec596c
Add setHTMLUnsafe and parseHTMLUnsafe methods
josepharhar Jul 19, 2023
345c888
wrote more stuff
josepharhar Jul 20, 2023
63abb16
fix idl
josepharhar Jul 20, 2023
5dea87f
make parsehtmlunsafe static
josepharhar Jul 20, 2023
ff03967
resolve todo
josepharhar Aug 8, 2023
bebbe37
Merge remote-tracking branch 'upstream/main' into sethtml
josepharhar Aug 8, 2023
3b7e41f
improve idl
josepharhar Aug 15, 2023
b1438c7
add domparser heading
josepharhar Aug 15, 2023
cb99174
typo + static
josepharhar Aug 15, 2023
7a7c1ee
feedback
josepharhar Aug 15, 2023
086e203
fix fragment parsing reference
josepharhar Aug 15, 2023
4909dc6
nits
josepharhar Aug 15, 2023
39dca26
nits
josepharhar Aug 22, 2023
d522f14
more nits
josepharhar Aug 22, 2023
b3e163e
add to shadowroot
josepharhar Aug 24, 2023
34027c9
merge shadowroot into documentorshadowroot and hoist template
josepharhar Aug 26, 2023
8c5386d
domstring
josepharhar Aug 26, 2023
aa3e231
add missing li
josepharhar Aug 26, 2023
46bc656
Merge branch 'main' into sethtml
josepharhar Sep 5, 2023
6ed235b
move shadowroot to dynamic markup insertion
josepharhar Sep 6, 2023
e28361b
string->html
josepharhar Sep 6, 2023
3fed030
stuff
josepharhar Sep 21, 2023
090d6a8
add scripting note
josepharhar Sep 21, 2023
b6f859c
say which element provides context to parser
josepharhar Sep 21, 2023
31ade1b
note->warning
josepharhar Sep 21, 2023
0c1331e
,->;
josepharhar Sep 21, 2023
d8e8f2c
Final touches
domenic Oct 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
110 changes: 92 additions & 18 deletions source
View file
Open in desktop
Expand Up @@ -3343,6 +3343,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
<ul class="brief">
<li><dfn data-x="dom-innerHTML" data-x-href="https://w3c.github.io/DOM-Parsing/#dom-element-innerhtml"><code>innerHTML</code></dfn></li>
<li><dfn data-x="dom-outerHTML" data-x-href="https://w3c.github.io/DOM-Parsing/#dom-element-outerhtml"><code>outerHTML</code></dfn></li>
<li><dfn data-x-href="https://w3c.github.io/DOM-Parsing/#dfn-fragment-parsing-algorithm">fragment parsing algorithm</dfn></li>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved
</ul>

<p>The following features are defined in <cite>Selection API</cite>: <ref>SELECTION</ref></p>
Expand Down Expand Up @@ -10606,6 +10607,7 @@ partial interface <dfn id="document" data-lt="">Document</dfn> {
[<span>CEReactions</span>] undefined <span data-x="dom-document-close">close</span>();
[<span>CEReactions</span>] undefined <span data-x="dom-document-write">write</span>(DOMString... text);
[<span>CEReactions</span>] undefined <span data-x="dom-document-writeln">writeln</span>(DOMString... text);
static <code>Document</code> <span data-x="dom-parseHTMLUnsafe">parseHTMLUnsafe</span>(string html);
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

// <span>user interaction</span>
readonly attribute <span>WindowProxy</span>? <span data-x="dom-document-defaultView">defaultView</span>;
Expand Down Expand Up @@ -108860,6 +108862,8 @@ document.body.appendChild(frame)</code></pre>
also live here? -->
<h3 id="dom-parsing-and-serialization">DOM parsing</h3>

<h4>The <code>DOMParser</code> interface</h4>

<p>The <code>DOMParser</code> interface allows authors to create new <code>Document</code> objects
by parsing strings, as either HTML or XML.</p>

Expand Down Expand Up @@ -108920,7 +108924,7 @@ enum <dfn enum>DOMParserSupportedType</dfn> {
<li>
<p>Let <var>document</var> be a new <code>Document</code>, whose <span
data-x="concept-document-content-type">content type</span> is <var>type</var> and <span
data-x="concept-document-URL">url</span> is this's <span>relevant global object</span>'s <span
data-x="concept-document-URL">URL</span> is this's <span>relevant global object</span>'s <span
data-x="concept-document-window">associated <code>Document</code></span>'s <span
data-x="concept-document-URL">URL</span>.</p>
<!-- When https://github.com/whatwg/html/issues/4792 gets fixed we need to investigate which of
Expand All @@ -108941,23 +108945,8 @@ enum <dfn enum>DOMParserSupportedType</dfn> {
data-x="dom-DOMParserSupportedType-texthtml"><code>text/html</code>"</dfn></dt>
<dd>
<ol>
<li><p>Set <var>document</var>'s <span data-x="concept-document-type">type</span> to "<code
data-x="">html</code>".</p></li>

<li><p>Create an <span>HTML parser</span> <var>parser</var>, associated with
<var>document</var>.</p></li>

<li><p>Place <var>string</var> into the <span>input stream</span> for <var>parser</var>. The
encoding <span data-x="concept-encoding-confidence">confidence</span> is
<i>irrelevant</i>.</p></li>

<li>
<p>Start <var>parser</var> and let it run until it has consumed all the characters just
inserted into the input stream.</p>

<p class="note">This might mutate the document's <span
data-x="concept-document-mode">mode</span>.</p>
</li>
<li><p><span>Parse HTML from a string</span> given <var>document</var> and
<var>string</var>.</p></li>
</ol>

<p class="note">Since <var>document</var> does not have a <span
Expand Down Expand Up @@ -108999,8 +108988,93 @@ enum <dfn enum>DOMParserSupportedType</dfn> {
<li><p>Return <var>document</var>.</p>
</ol>

<p>To <dfn>parse HTML from a string</dfn>, given a <var>document</var> <code>Document</code> and a
<span>string</span> <var>string</var>:</p>

<ol>
<li><p>Set <var>document</var>'s <span data-x="concept-document-type">type</span> to "<code
data-x="">html</code>".</p></li>

<li><p>Create an <span>HTML parser</span> <var>parser</var>, associated with
<var>document</var>.</p></li>

<li><p>Place <var>string</var> into the <span>input stream</span> for <var>parser</var>. The
encoding <span data-x="concept-encoding-confidence">confidence</span> is
<i>irrelevant</i>.</p></li>

<li>
<p>Start <var>parser</var> and let it run until it has consumed all the characters just
inserted into the input stream.</p>

<p class="note">This might mutate the document's <span
data-x="concept-document-mode">mode</span>.</p>
</li>
</ol>

</div>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

<h4>Unsafe HTML parsing methods</h4>

<dl class="domintro">
<dt><code data-x=""><var>element</var>.<span subdfn
data-x="dom-setHTMLUnsafe">setHTMLUnsafe</span>(<var>string</var>)</code></dt>

<dd>
domenic marked this conversation as resolved.
Show resolved Hide resolved
<p>Parses <var>string</var> using the HTML parser, and replaces the children of
<var>element</var> with the result.</p>
</dd>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

<dt><code data-x=""><var>doc</var> = <var>Document</var>.<span
josepharhar marked this conversation as resolved.
Show resolved Hide resolved
data-x="dom-parseHTMLUnsafe">parseHTMLUnsafe</span>(<var>string</var>)</code></dt>

<dd>
<p>Parses <var>string</var> using the HTML parser, and returns the resulting
<code>Document</code>.</p>
</dd>
</dl>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

domenic marked this conversation as resolved.
Show resolved Hide resolved
<p class="note">These methods perform no sanitization to remove potentially-dangerous elements and
attributes like <code>script</code> or <span>event handler content attributes</span>.</p>

josepharhar marked this conversation as resolved.
Show resolved Hide resolved
<pre><code class="idl">partial interface <span id="Element-partial">Element</span> {
domenic marked this conversation as resolved.
Show resolved Hide resolved
undefined <span data-x="dom-setHTMLUnsafe">setHTMLUnsafe</span>(DOMString string);
};</code></pre>

<p>The <dfn method for="Element"><code
josepharhar marked this conversation as resolved.
Show resolved Hide resolved
data-x="dom-setHTMLUnsafe">setHTMLUnsafe(<var>string</var>)</code></dfn> method steps are:</p>

<ol>
<li><p>Let <var>newChildren</var> be the result of the <span>HTML fragment parsing algorithm</span>
given <span>this</span> and <var>string</var>.</p></li>

josepharhar marked this conversation as resolved.
Show resolved Hide resolved
<li><p>Let <var>fragment</var> be a new <code>DocumentFragment</code> whose <span>node
document</span> is <span>this</span>'s <span>node document</span>.</p></li>

josepharhar marked this conversation as resolved.
Show resolved Hide resolved
<li><p><span data-x="concept-node-append">Append</span> each <code>Node</code> in
<var>newChildren</var> to <var>fragment</var> in <span>tree order</span>.</p></li>
domenic marked this conversation as resolved.
Show resolved Hide resolved
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

josepharhar marked this conversation as resolved.
Show resolved Hide resolved
<li><p>Let <var>target</var> be <span>this</span>'s <span>template contents</span> if
<span>this</span> is a <code>template</code> element; otherwise <span>this</span>.</p></li>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

<li><p><span data-x="concept-node-replace-all">Replace all</span> with <var>fragment</var> within
<var>target</var>.</p></li>
</ol>
annevk marked this conversation as resolved.
Show resolved Hide resolved

<p>The <dfn method for="Document"><code
data-x="dom-parseHTMLUnsafe">Document.parseHTMLUnsafe(<var>string</var>)</code></dfn> method steps
are:</p>
josepharhar marked this conversation as resolved.
Show resolved Hide resolved

<ol>
<li><p>Let <var>document</var> be a new <code>Document</code>, whose <span
data-x="concept-document-content-type">content type</span> is "<code
data-x="">text/html</code>".</p></li>

josepharhar marked this conversation as resolved.
Show resolved Hide resolved
<li><p><span>Parse HTML from a string</span> given <var>document</var> and
josepharhar marked this conversation as resolved.
Show resolved Hide resolved
<var>string</var>.</p></li>

<li><p>Return <var>document</var>.</p></li>
</ol>


<h3 split-filename="timers-and-user-prompts" id="timers">Timers</h3>

Expand Down