Add HTML setters features - #4318
Conversation
github-actions
Bot
added
the
feature definition
| @@ -0,0 +1,44 @@ | |||
| name: HTML positional setters | |||
| description: The setHTML(), replaceWithHTML(), beforeHTML(), prependHTML(), appendHTML() and afterHTML() methods, and unsafe equivalents, insert HTML into an existing tree. | |||
| spec: https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-parsing-and-serialization | |||
There was a problem hiding this comment.
This is actually waiting on whatwg/html#12753 before it's added to this section of the HTML spec. But that's pretty close now and is just waiting on some final reviews.
| @@ -0,0 +1,43 @@ | |||
| name: HTML streaming setters | |||
| description: The streamHTML(), streamReplaceWithHTML(), streamBeforeHTML(), streamPrependHTML(), streamAppendHTML() and streamAfterHTML() methods, and unsafe equivalents, return writeable streams that incrementally insert HTML into an existing tree. | |||
| spec: https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-parsing-and-serialization | |||
There was a problem hiding this comment.
Same for this one that's waiting on whatwg/html#12758 also pretty close to landing
| @@ -0,0 +1,44 @@ | |||
| name: HTML positional setters | |||
| description: The setHTML(), replaceWithHTML(), beforeHTML(), prependHTML(), appendHTML() and afterHTML() methods, and unsafe equivalents, insert HTML into an existing tree. | |||
There was a problem hiding this comment.
| description: The setHTML(), replaceWithHTML(), beforeHTML(), prependHTML(), appendHTML() and afterHTML() methods, and unsafe equivalents, insert HTML into an existing tree. | |
| description: The `setHTML()`, `replaceWithHTML()`, `beforeHTML()`, `prependHTML()`, `appendHTML()` and `afterHTML()` methods, and unsafe equivalents, insert HTML into an existing tree. |
There was a problem hiding this comment.
Do we need to say what these are methods on?
Also, there seems to be some overlap with sanitizer and parse-html-unsafe - some of the methods mentioned here are in the other features. I'm not quite sure what the solution is there.
There was a problem hiding this comment.
There was a bit of discussion on this in the issue (#4117) with @ddbeck .
Only the setHTMLUnsafe and setHTMLUnsafe overlap, which is why I've only added api.Element.setHTMLUnsafe.options_runscripts_parameter here. Think of this feature as expanding on that initial implementation, both in those methods and in creating additional, adjacent methods.
Personally I disagree with setHTML being part of Sanitzer. It was the first use of Sanitizing so added as part of that, but it's more a user of it, than part of the API IMHO (as are these).
Ultimately I'd like to see both those methods brought in here, but while this is early, and Chrome-only, and those are supported by other browsers that's likely to cause more confusion. So, while I agree this is not ideal, I think it's the best option for now.
There was a problem hiding this comment.
Do we need to say what these are methods on?
Sorry forgot to answer this bit. That was @ddbeck 's original suggestion in #4117 (comment).
Personally I think this is a bit verbose:
The
setHTML(),replaceWithHTML(),beforeHTML(),prependHTML(),appendHTML()andafterHTML()methods of the CharacterData, Element, DocumentType, and ShadowRoot (and their unsafe equivalents), insert HTML into an existing tree.
It's also not accurate since only half of them apply to all and the other half to just Element and ShadowRoot.
I think it's fairly obvious these are DOM methods and apply to the appropriate places and MDN, the spec or other documentation sites are the best place to get this level of detail.
There was a problem hiding this comment.
We could say "DOM methods" if preferred?
The setHTML(), replaceWithHTML(), beforeHTML(), prependHTML(), appendHTML() and afterHTML() DOM methods, and their unsafe equivalents, insert HTML into an existing tree.
There was a problem hiding this comment.
We also also take a slightly more aggressive stance here and:
- Move
setHTMLout of the sanitizer.yml feature and into here (leaving the rest of the Sanitzer API in there). As I say it's not quite right being in there IMHO. Firefox would still show as supporting the Sanitizer API, but no longer show support ofsetHTMLsince it would now be part of this wider feature that they haven't fully implemented. - Move
setHTMLUnsafeout ofparse-html-unsafeinto here (leavingapi.Document.parseHTMLUnsafe_staticin there). Firefox and Safari would still show as supportingparseHTMLUnsafebut no longer show support ofsetHTMLUnsafesince it would now be part of this wider feature that they haven't fully implemented.
That would be less confusing and ultimately where we want to go longer term.
Then longer, longer term this feature gets folded into dom anyway.
WDYT?
There was a problem hiding this comment.
I think the feature composition as you have it makes sense- sorry for rehashing existing conversations!
We could say "DOM methods" if preferred?
The setHTML(), replaceWithHTML(), beforeHTML(), prependHTML(), appendHTML() and afterHTML() DOM methods, and their unsafe equivalents, insert HTML into an existing tree.
This sounds good to me. And you're right that this isn't the place for the amount of specificity needed to full describe the API.
There was a problem hiding this comment.
Updated description to "DOM methods".
I'm actually more and more thinking we should just bite the bullet and move setHTML and setHTMLUnsafe. Especially as we are merging these into the HTML spec, so this is not just some Chrome proposal. I've added that to this PR in de89f56 so you can see what that looks like. Let's also see what @ddbeck thinks here.
Co-authored-by: James Stuckey Weber <james@oddbird.net>
2 participants
Fixes #4117
Due for launch in Chrome 154
Spec updates still WIP but have added commented out lines for them in the meantime.