Upstream sanitizer api by noamr · Pull Request #12395 · whatwg/html

noamr · 2026-04-21T13:16:44Z

Convert the incubated spec in https://wicg.github.io/sanitizer-api/ to the HTML format and make it part of the HTML standard.

At least two implementers are interested (and none opposed):
- Gecko/Chromium already shipping
Tests are written and can be reviewed and commented upon at:
- Remove "tentative" from sanitizer API tests. web-platform-tests/wpt#59400
Implementation bugs are filed:
- Chromium: already supported
- Gecko: already supported
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=303808
Corresponding HTML AAM & ARIA in HTML issues & PRs: N/A
MDN issue is filed: already there: https://developer.mozilla.org/en-US/docs/Web/API/Sanitizer
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/canvas.html ( diff )
/comms.html ( diff )
/dom.html ( diff )
/dynamic-markup-insertion.html ( diff )
/edits.html ( diff )
/embedded-content-other.html ( diff )
/form-elements.html ( diff )
/forms.html ( diff )
/grouping-content.html ( diff )
/iframe-embed-object.html ( diff )
/image-maps.html ( diff )
/imagebitmap-and-animations.html ( diff )
/index.html ( diff )
/indices.html ( diff )
/infrastructure.html ( diff )
/input.html ( diff )
/interaction.html ( diff )
/microdata.html ( diff )
/parsing.html ( diff )
/references.html ( diff )
/rendering.html ( diff )
/scripting.html ( diff )
/sections.html ( diff )
/semantics.html ( diff )
/system-state.html ( diff )
/tables.html ( diff )
/text-level-semantics.html ( diff )
/timers-and-user-prompts.html ( diff )
/web-messaging.html ( diff )
/webstorage.html ( diff )
/workers.html ( diff )

noamr · 2026-04-21T20:11:47Z

@zcorpan @evilpie @mozfreddyb @otherdaniel
initial review? :)
this is quite a big PR...

evilpie · 2026-04-22T10:07:01Z

Amazing, thanks for working on this.

The built-in safe default configuration is pretty integral to the API, where did I go?

For anyone else looking at this, the gist of the changes are in dynamic-markup-insertion.html.

noamr · 2026-04-22T10:26:27Z

Amazing, thanks for working on this.

The built-in safe default configuration is pretty integral to the API, where did I go?

Oh you're right I had it on my todo list and forgot. Getting to it. Thanks!

noamr · 2026-04-22T10:54:17Z

Amazing, thanks for working on this.
The built-in safe default configuration is pretty integral to the API, where did I go?

Oh you're right I had it on my todo list and forgot. Getting to it. Thanks!

Done.

annevk · 2026-04-22T20:43:22Z

I thought as part of moving this into the HTML standard we'd also address the parser integration issue?

noamr · 2026-04-23T07:33:37Z

I thought as part of moving this into the HTML standard we'd also address the parser integration issue?

This is a huge PR so I thought doing it in two stages, the first one being a purely technical upstream, would be easier to review?

Open and happy to incorporate the stream-while-parsing changes in this PR if you and @zcorpan are ok to review that in one go.

noamr · 2026-04-23T07:58:32Z

@zcorpan @annevk can we align on whether we upstream the sanitizer as is and then change it to stream-while-parsing, or do it in one go? I'm perfectly happy with both options.

zcorpan · 2026-04-23T08:59:38Z

I prefer doing the parser integration in a follow-up PR.

evilpie · 2026-04-23T11:29:55Z

I think these three PRs would be good to merge before merging into the HTML standard:

noamr · 2026-04-23T12:16:00Z

I think these three PRs would be good to merge before merging into the HTML standard:

Remove custom element state when is attribute is blocked WICG/sanitizer-api#396

Clarify condition by splitting it up into explicitly named bools. WICG/sanitizer-api#385

Replace replace all with steps from replaceWith. WICG/sanitizer-api#375

Since some security sensitive changes rely on "sanitizing while parsing", and that in turn relies on the current post-processing sanitizer being upstreamed, I don't think we should delay upstreaming any further.

Can we race it? If any of these go in before the upstream PR is in I'll incorporate them into the HTML PR.

noamr · 2026-04-28T08:34:51Z

+  data-x="dom-SanitizerProcessingInstruction-target">target</code> member.</p>
+  </div>
+
+  <div algorithm>


These algorithms look like they belong in infra... would people be open to adding an optional comparator predicate to those, or to the definition of list/order set?

@annevk @zcorpan

Moving this to Infra SGTM.

Opened whatwg/infra#709 for now.
I'm not sure about the comparator thing - infra doesn't really say what it means that two items in a list are the same. Would it be enough to mention here whaht makes items of attributes/elements/... lists "equal"

otherdaniel

Thank you, and I'm super happy to see this happening!

I wonder if we can link to the "Security Considerations" section in the current spec; or have them in a supplementary document somewhere?

otherdaniel

Thank you, and I'm super happy to see this happening!

I wonder if we can link to the "Security Considerations" section in the current spec; or have them in a supplementary document somewhere?

noamr · 2026-04-28T13:22:15Z

Thank you, and I'm super happy to see this happening!

I wonder if we can link to the "Security Considerations" section in the current spec; or have them in a supplementary document somewhere?

I've upstreamed them instead into a security consideration subsection

noamr · 2026-04-30T12:25:29Z

I've refactored some of the sanitization constants to go into each element's definition instead of being in one huge table. I think that makes it less error prone when we add new elements in the future. If that's undesirable I'm happy to revert.

zcorpan · 2026-05-06T08:21:58Z

+  data-x="dom-SanitizerProcessingInstruction-target">target</code> member.</p>
+  </div>
+
+  <div algorithm>


Moving this to Infra SGTM.

…nition lists near the top of the file

Fixes WICG/sanitizer-api#206

…ibutes

zcorpan · 2026-05-22T13:25:11Z

I believe everything normative is now equivalent to the WICG spec.

otherdaniel

Gave this a complete read, and this looks great!

Have some (entirely optional) comments below.

otherdaniel · 2026-05-22T17:25:32Z

+        <ol>
+         <li><p>Set <var>element</var>["<code
+         data-x="dom-SanitizerElementNamespaceWithAttributes-attributes">attributes</code>"] to the
+         result of <span data-x="set create">removing duplicates</span> from


"remove duplicates" is now mapped to "create a set", which does the same operation. If so, I think we can just call it that.

otherdaniel · 2026-05-22T17:38:08Z

+};</code></pre>
+
+  <p><code>SanitizerElementNamespace</code>, <code>SanitizerAttributeNamespace</code>,
+  <code>SanitizerAttribute</code>, and <code>SanitizerProcessingInstruction</code> dictionaries are


SanitizerAttribute isn't a dictionary; it's a typedef of a union. Is SanitizerElementNamespaceWithAttributes meant?

otherdaniel · 2026-05-22T17:41:06Z

+    <p>If all of the following are true:</p>
+
+    <ul class="brief">
+     <li><p><var>safe</var> is true;</p></li>


The paragraph above asks for 'all of the following' to be true, and this asks for |safe| to be true. While correct, I think the condition is redundant.

otherdaniel · 2026-05-22T17:57:33Z

+    </tr>
+    <tr>
+      <td><code data-x="SVG title">title</code></td>
+      <td><span data-x="SVG namespace">SVG</span></td>


Missing an empty <td></td>. The third column is currently "merged" with the following box; or at least it looks that way.

otherdaniel · 2026-05-22T18:01:35Z

+
+  <!-- NON-NORMATIVE SECTION -->
+
+  <p>Mutation XSS or mXSS describes an attack that exploits cases where the parsed DOM structure is


I think readability would benefit from splitting this up in paragraphs (as it originally was, https://wicg.github.io/sanitizer-api/#mutated-xss)

noamr marked this pull request as draft April 21, 2026 13:16

noamr changed the base branch from zcorpan/upstream-sanitizer-api to main April 21, 2026 13:17

noamr changed the title ~~WIP upstream sanitizer api~~ Upstream sanitizer api Apr 21, 2026

noamr force-pushed the zcorpan/upstream-sanitizer-api branch from 223a4d1 to d2034e5 Compare April 21, 2026 19:42

zcorpan reviewed Apr 22, 2026

View reviewed changes

Comment thread source

Comment thread source Outdated

noamr marked this pull request as ready for review April 22, 2026 10:56

zcorpan reviewed Apr 22, 2026

View reviewed changes

Comment thread source Outdated

noamr added the agenda+ To be discussed at a triage meeting label Apr 23, 2026

evilpie reviewed Apr 23, 2026

View reviewed changes

Comment thread source Outdated

noamr removed the agenda+ To be discussed at a triage meeting label Apr 23, 2026

noamr closed this Apr 23, 2026

noamr reopened this Apr 23, 2026

noamr commented Apr 28, 2026

View reviewed changes

otherdaniel reviewed Apr 28, 2026

View reviewed changes

Comment thread source Outdated

Comment thread source Outdated

Comment thread source Outdated

otherdaniel reviewed Apr 28, 2026

View reviewed changes

noamr force-pushed the zcorpan/upstream-sanitizer-api branch from ea79a5b to 1e065df Compare April 28, 2026 13:07

annevk reviewed Apr 28, 2026

View reviewed changes

Comment thread source Outdated

Comment thread source Outdated

Comment thread source Outdated

Comment thread source Outdated

zcorpan requested changes May 6, 2026

View reviewed changes

zcorpan and others added 23 commits May 22, 2026 14:41

xlink -> XLink

0fed807

Lots of small changes

074f1bd

Fix more LLM-found issues

7cb1008

More LLM-covered issues

e438ee7

improve constructor wording

0f4c626

Nits

fbfc412

Fix more issues from AI review

37624e3

Fix a few more elements

b252b3e

Register SVG/MathML presentation attributes in the external spec defi…

9e18601

…nition lists near the top of the file

More xref fixes

0d52c43

Nits

71f2191

Fix wording

f61b257

non-normative

5b457cb

move baseline attributes to a list

af9f6fc

More nits

f37f7b8

Don't capitalize each word in <th>, add an omitted cell

96f35dc

Update editor's checklist

5b1942e

Fixes WICG/sanitizer-api#206

Stop using ', then:'

f5aa346

Fix casing in variable names

3e6e317

Assert configuration is valid in PI methods

6f0cd0a

nits

6969a61

import with default

836a306

Nits

b3593af

zcorpan force-pushed the zcorpan/upstream-sanitizer-api branch from 5866163 to b3593af Compare May 22, 2026 13:00

zcorpan added 4 commits May 22, 2026 15:01

specfmt

580dddb

Empty cells

8e29ac9

Remove <summary> from 'included by default'

30ac8ee

Add <button formaction> and <input formaction> to Navigating URL attr…

44a94de

…ibutes

otherdaniel reviewed May 22, 2026

View reviewed changes


		<!-- NON-NORMATIVE SECTION -->

		<p>Mutation XSS or mXSS describes an attack that exploits cases where the parsed DOM structure is

Conversation

noamr commented Apr 21, 2026 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Apr 21, 2026

Uh oh!

evilpie commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Apr 22, 2026

Uh oh!

Uh oh!

Uh oh!

noamr commented Apr 22, 2026

Uh oh!

Uh oh!

annevk commented Apr 22, 2026

Uh oh!

noamr commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamr commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zcorpan commented Apr 23, 2026

Uh oh!

Uh oh!

evilpie commented Apr 23, 2026

Uh oh!

noamr commented Apr 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

otherdaniel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

otherdaniel left a comment

Choose a reason for hiding this comment

Uh oh!

noamr commented Apr 28, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

noamr commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zcorpan commented May 22, 2026

Uh oh!

otherdaniel left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

noamr commented Apr 21, 2026 •

edited by pr-preview Bot

Loading

evilpie commented Apr 22, 2026 •

edited

Loading

noamr commented Apr 23, 2026 •

edited

Loading

noamr commented Apr 23, 2026 •

edited

Loading

noamr commented Apr 30, 2026 •

edited

Loading