2023-05-03 meeting notes

[annevk]

• Mozilla’s Sanitizer API Position document
• Google’s Sanitizer API Position document

General agreement on:

• Some string -> Document with a filter API (e.g., Document.parseUnsafe())
• Some string -> Document with a must-be-safe filter API (e.g., Document.parse())
• Some string -> parse + insert with a filter API (e.g. element.setHTMLUnsafe())
• Some string -> parse + insert with a must-be-safe filter API (e.g. element.setHTML())

Details to discuss:

• How are filters delivered? { filter } or { sanitizer } or { filter } for one and { sanitizer } for the other?
• Are filters dictionaries or Sanitizer objects or either allowed or ...?
  • If there were to be a Sanitizer object it should be useful, e.g. with properties reflecting the "resolved" allowlists you could inspect.
• Should there be positional methods?
  • Previous discussion at HTML triage meeting: Upcoming HTML standard issue triage meeting on 3/9/2023 whatwg/html#8942 (comment)

[shgysk8zer0]

I am struggling to understand what changed in the new API design.

• I noticed all mentions of Sanitizer have been removed
• The WICG unofficial draft (2023-05-31) is still mostly about the construction and methods, etc. of Sanitizer
• The current explainer has no examples
• Explainer examples #194 Adds examples using element.setHTML & Document.parseHTML that seem to imply passing the options/filter directly to these methods (element.setHTML(html, { allowElements, allowAttributes })) instead of element.setHTML(html, { sanitizer: new Sanitizer({ allowElements, allowAttributes}) })
• Those examples also differ greatly in structure from the default configuration dictionary (possibly to address SVG and MathML)

I get the impression that Sanitizer has been removed and that setHTML & parseHTML are the direction this is heading, possibly passing in what was formerly the the arguments to new Sanitizer(config). Is this correct?

[annevk]

Mostly, but Sanitizer or something like it might make a comeback if it can be independently useful, see https://github.com/WICG/sanitizer-api/blob/main/explainer.md#open-questions. The current object doesn't do anything at which point it might as well be a dictionary.

[annevk]

No need to keep this open, for the latest see #196.