Skip to content

Upstream the Sanitizer API (WIP)#12314

Draft
zcorpan wants to merge 86 commits into
mainfrom
zcorpan/upstream-sanitizer-api
Draft

Upstream the Sanitizer API (WIP)#12314
zcorpan wants to merge 86 commits into
mainfrom
zcorpan/upstream-sanitizer-api

Conversation

@zcorpan
Copy link
Copy Markdown
Member

@zcorpan zcorpan commented Mar 25, 2026

See WICG/sanitizer-api#291

  • At least two implementers are interested (and none opposed):
  • Tests are written and can be reviewed and commented upon at:
  • Implementation bugs are filed:
    • Chromium: …
    • Gecko: …
    • WebKit: …
    • Deno (only for timers, structured clone, base64 utils, channel messaging, module resolution, web workers, and web storage): …
    • Node.js (only for timers, structured clone, base64 utils, channel messaging, and module resolution): …
  • Corresponding HTML AAM & ARIA in HTML issues & PRs:
  • MDN issue is filed: …
  • The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)


/acknowledgements.html ( diff )
/browsing-the-web.html ( diff )
/canvas.html ( diff )
/comms.html ( diff )
/custom-elements.html ( diff )
/document-lifecycle.html ( diff )
/document-sequences.html ( diff )
/dom.html ( diff )
/dynamic-markup-insertion.html ( diff )
/edits.html ( diff )
/embedded-content-other.html ( diff )
/embedded-content.html ( diff )
/form-elements.html ( diff )
/forms.html ( diff )
/grouping-content.html ( diff )
/iframe-embed-object.html ( diff )
/image-maps.html ( diff )
/imagebitmap-and-animations.html ( diff )
/images.html ( diff )
/index.html ( diff )
/indices.html ( diff )
/infrastructure.html ( diff )
/interaction.html ( diff )
/interactive-elements.html ( diff )
/links.html ( diff )
/media.html ( diff )
/microdata.html ( diff )
/nav-history-apis.html ( diff )
/parsing.html ( diff )
/popover.html ( diff )
/references.html ( diff )
/rendering.html ( diff )
/scripting.html ( diff )
/sections.html ( diff )
/semantics-other.html ( diff )
/semantics.html ( diff )
/system-state.html ( diff )
/tables.html ( diff )
/text-level-semantics.html ( diff )
/timers-and-user-prompts.html ( diff )
/urls-and-fetching.html ( diff )
/web-messaging.html ( diff )
/webappapis.html ( diff )
/webstorage.html ( diff )
/workers.html ( diff )

zcorpan and others added 30 commits March 25, 2026 17:24
This cannot happen inside the Make Active algorithm, since that gets called during document creation, which commonly happens before the document's navigable is created.
connectedMoveCallback is moved before adoptedCallback.

Fixes #12016.
Adds support for the `{ type: 'text' }` import attribute,
which enables importing text content as a JavaScript string.

Part of #9444
Invoke the HTML and XML fragment parsing algorithms separately, since they take different arguments. Also use 'parser scripting mode' for the HTML fragment parsing algorithms  as the fragment parser sets the parsing mode to the 'Disabled' which is wider than the fragment parsing mode definition.
Prevents a 404 error on them when using the commit-snapshots.
Add a new `controls` attribute to the `img` element that allows the user agent to add an interactive user interface over the image.

Animated images follow-up tracked by #12318.

Fixes #11856.
… dimension

Unfortunately the more correct behavior was never implemented widely enough and web content started to depend on these properties being non-0.

We take special care that dimensions that are missing do not get divided by density so we return the same values for them as CSS (300 by 150).

Tests: web-platform-tests/wpt#59304.

Fixes #11287.
Co-authored-by: Chris Wilson <cwilso@gmail.com>
Co-authored-by: sideshowbarker <mike@w3.org>
The Web App Manifest spec's "processing a manifest" algorithm now accepts an optional environment settings object (client) parameter, used to set the request client when fetching manifest image resources. This enables CSP and service worker interception for those fetches.

See w3c/manifest#1171 & w3c/image-resource#50 for context.
Also set default tabIndex value for MathML's a element to 0.

Tests: web-platform-tests/wpt#59631.

SVG and MathML PRs: w3c/svgwg#1103 & w3c/mathml-core#324.

Fixes #4702.
And align the muted getter with the :muted pseudo-class.

This also cleans up how we organize all the muted state. This removes the reliance on "creation-time" of the element which is completely bogus as whenever an element is created it has exactly 0 attributes.

Fixes #5013.
This PR makes option:disabled and optgroup:disabled match when either are inside disabled select elements, without changing the behavior of other algorithms like the selectedness setting algorithm when options are inside disabled selects. Also see w3c/csswg-drafts#13383
cf4109f made it so that technically the muted content attribute and playing backwards would result in a volumechange event. That was not intentional. This restores those aspects to before that commit and also modernizes the editorial style of the concepts involved.
This fixes a bug of having a dangling "url" variable.

The name that is passed to resource timing is the parsed URL that was initially passed to the iframe for navigation.

This codepath is "fallback resource timing" — it produces a resource timing entry for a cross-origin iframe that starts when the iframe is navigated and ends when the iframe's load event is fired, for iframes that don't produce actual resource timing based on fetch.

This is tested by https://wpt.fyi/results/resource-timing/cross-origin-iframe.html.

Closes #12122.
…cument navigation

Currently per spec, setting the ongoing navigation to "traversal" would abort the `navigate` event
and fire `navigateerror` (and abort the event's signal).

However, tests like [this one](https://github.com/web-platform-tests/wpt/blob/156bb7cbb8483f6ffd4b275a1ed0b628fd0582cc/navigation-api/ordering-and-transition/transition-cross-document.html#L25) say otherwise,
and this is not implemented.

In current implementations, the `ongoing navigate event` stays dangling, which creates unexpected results
when the page is restored from BFCache - the abort signal and `navigateerror` events fired as a result of
the next same-document navigation after being restored from BFCache.

This change makes it so that a succesful "traversal" (cross-document navigation) nullifies the ongoing
event, without "aborting" it, making it so that the navigation neither signals success or failure.

Closes #11860
- Markup: Change `<p>` to `</p>`
- Spelling: Change "elements" to "element"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.