Skip to content

Add stream{*}HTMLUnsafe() methods#11631

Draft
foolip wants to merge 40 commits intomainfrom
foolip/patching
Draft

Add stream{*}HTMLUnsafe() methods#11631
foolip wants to merge 40 commits intomainfrom
foolip/patching

Conversation

@foolip
Copy link
Copy Markdown
Member

@foolip foolip commented Sep 5, 2025

Fixes #2142.

  • At least two implementers are interested (and none opposed):
  • Tests are written and can be reviewed and commented upon at:
  • Implementation bugs are filed:
    • Chromium: …
    • Gecko: …
    • WebKit: …
    • Deno (only for timers, structured clone, base64 utils, channel messaging, module resolution, web workers, and web storage): …
    • Node.js (only for timers, structured clone, base64 utils, channel messaging, and module resolution): …
  • Corresponding HTML AAM & ARIA in HTML issues & PRs:
  • MDN issue is filed: …
  • The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)


/dynamic-markup-insertion.html ( diff )
/index.html ( diff )
/infrastructure.html ( diff )
/parsing.html ( diff )
/references.html ( diff )

@foolip foolip changed the title Add patchUnsafe() methods Add streamHTMLUnsafe() methods Oct 9, 2025
@foolip foolip marked this pull request as ready for review November 11, 2025 05:48
source Outdated
<ol>
<li><p><span data-x="concept-node-remove">Remove</span> all <var>target</var>'s <span
data-x="concept-tree-child">children</span>, in <span>tree order</span>, with the <i>suppress
observers flag</i> set.</p></li>
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This flag is currently internal to DOM (and just got renamed).

I also don't see how you are accounting for the suppression by creating your own mutation records. Am I missing something?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's actually no good reason to suppress mutation observer here, I tested it for innerHTML in https://software.hixie.ch/utilities/js/live-dom-viewer/?saved=14325 and mutation observer is triggered. I'll remove the flag here.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You probably have to use the "replace all" algorithm though as I doubt removing the nodes one-by-one gives the record we want here.

source Outdated
<li><p>Let <var>disposition</var> be the result of invoking the <span
data-x="tt-shouldblock">should sink type mismatch violation be blocked by content security
policy?</span> algorithm given <span>this</span>'s <span>relevant global object</span>,
"ShadowRoot streamHTMLUnsafe", "script", and "".</p></li>
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use <code> for string contents.

source Outdated
<ol>
<li><p>Let <var>input</var> be the result of <span
data-x="concept-idl-convert">converting</span> <var>chunk</var> to a <code
data-x="idl-DOMString">DOMString</code>. If this throws an exception, return <span>a promise
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

then return

source Outdated
data-x="concept-tree-child">children</span>, in <span>tree order</span>, with the <i>suppress
observers flag</i> set.</p></li>

<li> <p>Let <var>parser</var> be an <span>HTML parser</span> using the <span>streaming HTML
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<li> <p>Let <var>parser</var> be an <span>HTML parser</span> using the <span>streaming HTML
<li><p>Let <var>parser</var> be an <span>HTML parser</span> using the <span>streaming HTML

source Outdated
</ul>

<p class="XXX">Achieve the above by refactoring instead of enumerating the differences.</p>
</div>
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given that a lot of the complexity is here, I was hoping this would have been a bit more flushed out before the stage 2 request. The overall API shape seems fine, but I feel like as we're discussing this feature we keep discovering new issues with the supposedly "straightforward" HTML parser integration and we still don't quite know what that is going to look like.

Copy link
Copy Markdown
Member

@annevk annevk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there's another issue with how this works. Because it operates on the main document, you wouldn't be able to use declarative shadow trees. I think we need to make it work the way we want it to work for the Sanitizer API, minus the actual sanitization.

source Outdated
data-x="tt-shouldblock">should sink type mismatch violation be blocked by content security
policy?</span> algorithm given <span>this</span>'s <span>relevant global object</span>,
"<code data-x="">ShadowRoot streamHTMLUnsafe</code>", "<code data-x="">script</code>", and
"".</p></li>
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the empty string*

@noamr noamr force-pushed the foolip/patching branch from e7a2dcb to 8e82891 Compare March 24, 2026 20:13
@noamr noamr marked this pull request as draft March 24, 2026 20:16
@noamr noamr changed the title Add streamHTMLUnsafe() methods Add stream{*}HTMLUnsafe() methods Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

A way to stream content into an element

3 participants