Upstream sanitizer api by noamr · Pull Request #12395 · whatwg/html

noamr · 2026-04-21T13:16:44Z

Convert the incubated spec in https://wicg.github.io/sanitizer-api/ to the HTML format and make it part of the HTML standard.

At least two implementers are interested (and none opposed):
- Gecko/Chromium already shipping
Tests are written and can be reviewed and commented upon at:
- Remove "tentative" from sanitizer API tests. web-platform-tests/wpt#59400
Implementation bugs are filed:
- Chromium: already supported
- Gecko: already supported
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=303808
Corresponding HTML AAM & ARIA in HTML issues & PRs: N/A
MDN issue is filed: already there: https://developer.mozilla.org/en-US/docs/Web/API/Sanitizer
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/canvas.html ( diff )
/comms.html ( diff )
/dom.html ( diff )
/dynamic-markup-insertion.html ( diff )
/edits.html ( diff )
/embedded-content-other.html ( diff )
/form-elements.html ( diff )
/forms.html ( diff )
/grouping-content.html ( diff )
/iframe-embed-object.html ( diff )
/image-maps.html ( diff )
/imagebitmap-and-animations.html ( diff )
/index.html ( diff )
/indices.html ( diff )
/infrastructure.html ( diff )
/interaction.html ( diff )
/interactive-elements.html ( diff )
/microdata.html ( diff )
/parsing.html ( diff )
/references.html ( diff )
/rendering.html ( diff )
/scripting.html ( diff )
/sections.html ( diff )
/semantics.html ( diff )
/system-state.html ( diff )
/tables.html ( diff )
/text-level-semantics.html ( diff )
/timers-and-user-prompts.html ( diff )
/web-messaging.html ( diff )
/webstorage.html ( diff )
/workers.html ( diff )

noamr · 2026-04-21T20:11:47Z

@zcorpan @evilpie @mozfreddyb @otherdaniel
initial review? :)
this is quite a big PR...

evilpie · 2026-04-22T10:07:01Z

Amazing, thanks for working on this.

The built-in safe default configuration is pretty integral to the API, where did I go?

For anyone else looking at this, the gist of the changes are in dynamic-markup-insertion.html.

noamr · 2026-04-22T10:26:27Z

Amazing, thanks for working on this.

The built-in safe default configuration is pretty integral to the API, where did I go?

Oh you're right I had it on my todo list and forgot. Getting to it. Thanks!

noamr · 2026-04-22T10:54:17Z

Amazing, thanks for working on this.
The built-in safe default configuration is pretty integral to the API, where did I go?

Oh you're right I had it on my todo list and forgot. Getting to it. Thanks!

Done.

annevk · 2026-04-22T20:43:22Z

I thought as part of moving this into the HTML standard we'd also address the parser integration issue?

noamr · 2026-04-23T07:33:37Z

I thought as part of moving this into the HTML standard we'd also address the parser integration issue?

This is a huge PR so I thought doing it in two stages, the first one being a purely technical upstream, would be easier to review?

Open and happy to incorporate the stream-while-parsing changes in this PR if you and @zcorpan are ok to review that in one go.

noamr · 2026-04-23T07:58:32Z

@zcorpan @annevk can we align on whether we upstream the sanitizer as is and then change it to stream-while-parsing, or do it in one go? I'm perfectly happy with both options.

zcorpan · 2026-04-23T08:59:38Z

I prefer doing the parser integration in a follow-up PR.

evilpie · 2026-04-23T11:29:55Z

I think these three PRs would be good to merge before merging into the HTML standard:

noamr · 2026-04-23T12:16:00Z

I think these three PRs would be good to merge before merging into the HTML standard:

Remove custom element state when is attribute is blocked WICG/sanitizer-api#396

Clarify condition by splitting it up into explicitly named bools. WICG/sanitizer-api#385

Replace replace all with steps from replaceWith. WICG/sanitizer-api#375

Since some security sensitive changes rely on "sanitizing while parsing", and that in turn relies on the current post-processing sanitizer being upstreamed, I don't think we should delay upstreaming any further.

Can we race it? If any of these go in before the upstream PR is in I'll incorporate them into the HTML PR.

noamr · 2026-04-28T08:34:51Z

+  data-x="dom-SanitizerProcessingInstruction-target">target</code> member.</p>
+  </div>
+
+  <div algorithm>


These algorithms look like they belong in infra... would people be open to adding an optional comparator predicate to those, or to the definition of list/order set?

@annevk @zcorpan

Moving this to Infra SGTM.

Opened whatwg/infra#709 for now.
I'm not sure about the comparator thing - infra doesn't really say what it means that two items in a list are the same. Would it be enough to mention here whaht makes items of attributes/elements/... lists "equal"

otherdaniel

Thank you, and I'm super happy to see this happening!

I wonder if we can link to the "Security Considerations" section in the current spec; or have them in a supplementary document somewhere?

otherdaniel

Thank you, and I'm super happy to see this happening!

I wonder if we can link to the "Security Considerations" section in the current spec; or have them in a supplementary document somewhere?

noamr · 2026-04-28T13:22:15Z

Thank you, and I'm super happy to see this happening!

I wonder if we can link to the "Security Considerations" section in the current spec; or have them in a supplementary document somewhere?

I've upstreamed them instead into a security consideration subsection

noamr · 2026-04-30T12:25:29Z

I've refactored some of the sanitization constants to go into each element's definition instead of being in one huge table. I think that makes it less error prone when we add new elements in the future. If that's undesirable I'm happy to revert.

zcorpan · 2026-05-06T08:21:58Z

+  data-x="dom-SanitizerProcessingInstruction-target">target</code> member.</p>
+  </div>
+
+  <div algorithm>


Moving this to Infra SGTM.

zcorpan · 2026-05-20T14:40:17Z

+   <dd>« »</dd>
+
+   <dt><code data-x="dom-SanitizerConfig-attributes">attributes</code></dt>
+   <dd>all <span>global attributes</span>, alongside the MathML and SVG presentation attributes</dd>


https://wicg.github.io/sanitizer-api/#built-in-safe-default-configuration:~:text=%22processingInstructions%22%3A%20%5B%5D%2C%20%22attributes,null%20%7D%20%5D%2C doesn't list all global attributes. Which MathML and SVG presentation attributes?

zcorpan · 2026-05-20T14:49:02Z

@@ -16164,6 +16266,7 @@ interface <dfn interface>HTMLTitleElement</dfn> : <span>HTMLElement</span> {
   data-x="concept-element-accessibility-considerations">Accessibility considerations</span>:</dt>
   <dd><a href="https://w3c.github.io/html-aria/#el-base">For authors</a>.</dd>
   <dd><a href="https://w3c.github.io/html-aam/#el-base">For implementers</a>.</dd>
+   <dd><span>Navigating URL attributes</span>: <code data-x="attr-base-href">href</code>.</dd>


Missing
<dt><span data-x="concept-element-sanitization">Safe sanitization</span>:</dt>

Same issue for some other elements.

Do we need that for all elements? I only have it for removed/included by default elements

and there is this phrase:

<p>When specified, the <dfn data-x="concept-element-sanitization">safe sanitization</dfn> criteria for each element defines whether the element is <dfn data-x="sanitizer-removed">removed</dfn> or <dfn data-x="sanitizer-included-by-default">included by default</dfn> when performing safe sanitization. When unspecified, the element is not included by default, but can still be added by a <code>SanitizerConfig</code></p>

Should I define "allowed" as a 3rd option and define all of these?

Not needed for all elements, but as is now this line is under "accessibility considerations" which is not correct.

zcorpan · 2026-05-20T14:53:31Z

+       steps">sanitize</span> <var>child</var>'s <span>shadow root</span> given
+       <var>configuration</var> and <var>handleJavascriptNavigationUrls</var>.</p></li>
+
+       <li><p>Let <var>elementWithLocalAttributes</var> be « ».</p></li>


Should be «[ ]», right?

zcorpan · 2026-05-20T15:00:38Z

+   <dd><span>Navigating URL attributes</span>: <code data-x="attr-hyperlink-href">href</code>, <code
+   data-x="attr-hyperlink-hreflang">hreflang</code>, <code
+   data-x="attr-hyperlink-type">type</code>.</dd>


hreflang and type should not be listed here.

zcorpan · 2026-05-20T15:07:22Z

+  <h5 id="sanitizer-security-script-gadgets">XSS with script gadgets</h5>
+


Non-normative?

zcorpan · 2026-05-20T15:07:56Z

+  framework which then performs the execution of JavaScript based on that input.</p>
+
+  <p>The Sanitizer API can not prevent these attacks, but requires page authors to explicitly allow
+  unknown elements in general, and authors required to additionally explicitly configure unknown


"required" is a normative keyword (and "authors required" is not grammatically correct).

zcorpan · 2026-05-20T15:11:15Z

+    <tr>
+     <td><code data-x="SVG defs">defs</code>
+     <td><span data-x="SVG namespace">SVG</span>
+     <td> <tr>


Missing linebreak (also in more places in this table)

…nition lists near the top of the file

noamr marked this pull request as draft April 21, 2026 13:16

noamr changed the base branch from zcorpan/upstream-sanitizer-api to main April 21, 2026 13:17

noamr changed the title ~~WIP upstream sanitizer api~~ Upstream sanitizer api Apr 21, 2026

noamr force-pushed the zcorpan/upstream-sanitizer-api branch from 223a4d1 to d2034e5 Compare April 21, 2026 19:42

zcorpan reviewed Apr 22, 2026

View reviewed changes

Comment thread source

Comment thread source Outdated

noamr marked this pull request as ready for review April 22, 2026 10:56

zcorpan reviewed Apr 22, 2026

View reviewed changes

Comment thread source Outdated

noamr added the agenda+ To be discussed at a triage meeting label Apr 23, 2026

evilpie reviewed Apr 23, 2026

View reviewed changes

Comment thread source Outdated

noamr removed the agenda+ To be discussed at a triage meeting label Apr 23, 2026

noamr closed this Apr 23, 2026

noamr reopened this Apr 23, 2026

noamr commented Apr 28, 2026

View reviewed changes

otherdaniel reviewed Apr 28, 2026

View reviewed changes

Comment thread source Outdated

Comment thread source Outdated

Comment thread source Outdated

otherdaniel reviewed Apr 28, 2026

View reviewed changes

noamr force-pushed the zcorpan/upstream-sanitizer-api branch from ea79a5b to 1e065df Compare April 28, 2026 13:07

annevk reviewed Apr 28, 2026

View reviewed changes

Comment thread source Outdated

Comment thread source Outdated

Comment thread source Outdated

Comment thread source Outdated

zcorpan requested changes May 6, 2026

View reviewed changes

noamr added 5 commits May 12, 2026 20:35

refs

506866e

canonicalize

7caeb2f

nits

836ef18

nits

7709fd8

nits

305b169

noamr requested a review from zcorpan May 12, 2026 19:49

otherdaniel mentioned this pull request May 13, 2026

Replace replace all with steps from replaceWith. WICG/sanitizer-api#375

Merged

noamr added 3 commits May 13, 2026 12:02

Assimilate WICG/sanitizer-api#375

937eab4

typo

f807358

Fix some logic problems

020288f

zcorpan reviewed May 13, 2026

View reviewed changes

Comment thread source Outdated

zcorpan and others added 8 commits May 13, 2026 16:36

Formatting nits

6f3fd18

Add SVG a xlink

a6e57a5

Remove repetitive text in the mXSS section

5c1d6e7

xlink -> XLink

2979e61

Lots of small changes

0e37c1e

Fix more LLM-found issues

b3a7a05

More LLM-covered issues

bac58f1

improve constructor wording

57948b8

zcorpan requested changes May 20, 2026

View reviewed changes

zcorpan and others added 6 commits May 20, 2026 19:11

Nits

7aee3c6

Fix more issues from AI review

4ff564e

Fix a few more elements

f676ef3

Register SVG/MathML presentation attributes in the external spec defi…

6de0442

…nition lists near the top of the file

More xref fixes

242a83f

Nits

6ba99b9

noamr force-pushed the zcorpan/upstream-sanitizer-api branch from 5adaf4c to 6ba99b9 Compare May 20, 2026 20:40

noamr added 3 commits May 20, 2026 22:03

Fix wording

c000304

non-normative

94b0503

move baseline attributes to a list

2dc4df7

		<h5 id="sanitizer-security-script-gadgets">XSS with script gadgets</h5>

Conversation

noamr commented Apr 21, 2026 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Apr 21, 2026

Uh oh!

evilpie commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Apr 22, 2026

Uh oh!

Uh oh!

Uh oh!

noamr commented Apr 22, 2026

Uh oh!

Uh oh!

annevk commented Apr 22, 2026

Uh oh!

noamr commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zcorpan commented Apr 23, 2026

Uh oh!

Uh oh!

evilpie commented Apr 23, 2026

Uh oh!

noamr commented Apr 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

otherdaniel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

otherdaniel left a comment

Choose a reason for hiding this comment

Uh oh!

noamr commented Apr 28, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

noamr commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

noamr May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

noamr commented Apr 21, 2026 •

edited by pr-preview Bot

Loading

evilpie commented Apr 22, 2026 •

edited

Loading

noamr commented Apr 23, 2026 •

edited

Loading

noamr commented Apr 23, 2026 •

edited

Loading

noamr commented Apr 30, 2026 •

edited

Loading

noamr May 20, 2026 •

edited

Loading