I'm splitting this out from the discussion that starts on this comment #5465 (comment) and then jumps to overall issue comments starting here #5465 (comment). This was also previously discussed at length starting at this comment whatwg/dom#912 (comment). That issue has much more context on why there needs to be an opt-in for DSD at all.
The current spec PR has DOMParser.parseFromString(html,"text/html", {declarativeShadowRoots: true}) which is the only API that lets you imperatively parse HTML that contains declarative shadow roots.
There is a question about whether we need to add this, and whether instead we should make Sanitizer's setHTML() the only DSD-aware parser API. That requires some changes to the Sanitizer (#8627), in particular giving setHTML() a sanitizer: "unsafe-none" argument that bypasses all sanitization.
I'm splitting this out from the discussion that starts on this comment #5465 (comment) and then jumps to overall issue comments starting here #5465 (comment). This was also previously discussed at length starting at this comment whatwg/dom#912 (comment). That issue has much more context on why there needs to be an opt-in for DSD at all.
The current spec PR has
DOMParser.parseFromString(html,"text/html", {declarativeShadowRoots: true})which is the only API that lets you imperatively parse HTML that contains declarative shadow roots.There is a question about whether we need to add this, and whether instead we should make Sanitizer's
setHTML()the only DSD-aware parser API. That requires some changes to the Sanitizer (#8627), in particular givingsetHTML()asanitizer: "unsafe-none"argument that bypasses all sanitization.