diff --git a/source b/source index bed7090aed1..77b6dafc58f 100644 --- a/source +++ b/source @@ -5,6 +5,7 @@ ! - section for the element itself ! - descriptions of the element's categories ! - images/content-venn.svg + ! - sanitizer categories ! - syntax, if it's void or otherwise special ! - parser, if it's not phrasing-level ! - rendering @@ -14,6 +15,7 @@ ! Adding a new attribute involves editing the following sections: ! - The IDL and content attributes for the relevant elements ! - element and attribute indices + ! - sanitizer categories !--> + +

Web applications often need to process untrusted HTML strings, such as when rendering + user-generated content or using client-side templates. Safely inserting these strings into the DOM + requires careful sanitization to prevent DOM-based cross-site scripting (XSS) attacks.

+ +

HTML sanitization provides a native mechanism for safely parsing and sanitizing HTML strings. + By using the user agent's own HTML parser, they ensure the sanitized output accurately reflects + how the browser will render the content, preventing script execution and mitigating advanced + attacks such as script + gadgets.

+ +

These APIs offer functionality to parse a string containing HTML into a DOM tree, and to filter + the resulting tree according to a user-supplied configuration. The methods come in two main + flavors: "safe" and "unsafe".

+ +
Safe and unsafe
+ +

The "safe" methods will not generate any markup that executes script. That is, they are + intended to be safe from XSS. The "unsafe" methods will parse and filter based on the provided + configuration, but do not have the same safety guarantees by default.

+ +

The Sanitizer interface

+ + 
[Exposed=Window]
+interface Sanitizer {
+  constructor(optional (SanitizerConfig or SanitizerPresets) configuration = "default");
+
+  // Query configuration:
+  SanitizerConfig get();
+
+  // Modify a Sanitizer's lists and fields:
+  boolean allowElement(SanitizerElementWithAttributes element);
+  boolean removeElement(SanitizerElement element);
+  boolean replaceElementWithChildren(SanitizerElement element);
+  boolean allowProcessingInstruction(SanitizerPI pi);
+  boolean removeProcessingInstruction(SanitizerPI pi);
+  boolean allowAttribute(SanitizerAttribute attribute);
+  boolean removeAttribute(SanitizerAttribute attribute);
+  boolean setComments(boolean allow);
+  boolean setDataAttributes(boolean allow);
+
+  // Remove markup that executes script.
+  boolean removeUnsafe();
+};
+ +
+
config = sanitizer.get()
+

Returns a copy of the sanitizer's configuration.

+ +
sanitizer.allowElement(element)
+

Ensures that the sanitizer configuration allows the specified element.

+ +
sanitizer.removeElement(element)
+

Ensures that the sanitizer configuration blocks the specified element.

+ +
sanitizer.replaceElementWithChildren(element)
+

Configures the sanitizer to remove the specified element but keep its child + nodes.

+ +
sanitizer.allowAttribute(attribute)
+

Configures the sanitizer to allow the specified attribute globally.

+ +
sanitizer.removeAttribute(attribute)
+

Configures the sanitizer to block the specified attribute globally.

+ +
sanitizer.allowProcessingInstruction(pi)
+

Configures the sanitizer to allow the specified processing instruction.

+ +
sanitizer.removeProcessingInstruction(pi)
+

Configures the sanitizer to block the specified processing instruction.

+ +
sanitizer.setComments(allow)
+

Sets whether the sanitizer preserves comments.

+ +
sanitizer.setDataAttributes(allow)
+

Sets whether the sanitizer preserves custom data attributes (e.g., data-*).

+ +
sanitizer.removeUnsafe()
+

Modifies the configuration to automatically remove elements and attributes that are + considered unsafe.

+
+ +

A Sanitizer object has an associated configuration, + which is a SanitizerConfig.

+ +
+

The new + Sanitizer(configuration) constructor steps are:

+ +
    +
  1. +

    If configuration is a SanitizerPresets string:

    + +
      +

    1. Assert: configuration is "default".

      2. + +

    2. Set configuration to the built-in safe default + configuration.

      3. +
    +
    2. + +

  2. Configure this given + configuration and true.

    3. +
+
+ +
+

To configure a Sanitizer + sanitizer, given a dictionary configuration and a boolean + allowCommentsPIsAndDataAttributes:

+ +
    +

  1. Canonicalize the configuration configuration with + allowCommentsPIsAndDataAttributes.

    2. + +

  2. If configuration is not valid, + then throw a TypeError.

    3. + +

  3. Set sanitizer's configuration to + configuration.

    4. +
+
+ +
+

To canonicalize the configuration SanitizerConfig + configuration with a boolean allowCommentsPIsAndDataAttributes:

+ +
    +
  1. +

    For each member of configuration + that is a list of strings:

    + +
      +

    1. Replace each string in member with the result of canonicalizing it.

      2. +
    +
    2. + +

  2. If neither configuration["elements"] nor configuration["removeElements"] exists, then set configuration["removeElements"] to an empty list.

    3. + +

  3. If neither configuration["attributes"] nor configuration["removeAttributes"] exists, then set configuration["removeAttributes"] to an empty + list.

    4. + +
  4. +

    If neither configuration["processingInstructions"] nor + configuration["removeProcessingInstructions"] + exists:

    + +
      +

    1. If allowCommentsPIsAndDataAttributes is true, then set + configuration["removeProcessingInstructions"] + to an empty list.

      2. + +

    2. Otherwise, set configuration["processingInstructions"] to an empty + list.

      3. +
    +
    5. + + +
  5. +

    If configuration["elements"] + exists:

    + +
      +

    1. Let newElements be « ».

      2. + +

    2. For each element of + configuration["elements"], append the result of canonicalizing element to newElements.

      3. + +

    3. Set configuration["elements"] to newElements.

      4. +
    +
    6. + + +

  6. If configuration["removeElements"] exists, then set configuration["removeElements"] to the result of canonicalizing + configuration["removeElements"].

    7. + +

  7. If configuration["attributes"] exists, then set configuration["attributes"] to the result of canonicalizing configuration["attributes"].

    8. + +

  8. If configuration["removeAttributes"] exists, then set configuration["removeAttributes"] to the result of canonicalizing configuration["removeAttributes"].

    9. + +

  9. If configuration["replaceWithChildrenElements"] + exists, then set configuration["replaceWithChildrenElements"] to + the result of canonicalizing + configuration["replaceWithChildrenElements"].

    10. + +

  10. If configuration["processingInstructions"] exists, then set configuration["processingInstructions"] to the result + of canonicalizing + configuration["processingInstructions"].

    11. + +

  11. If configuration["removeProcessingInstructions"] + exists, then set configuration["removeProcessingInstructions"] + to the result of canonicalizing + configuration["removeProcessingInstructions"].

    12. + +

  12. If configuration["comments"] + does not exist, then set it to + allowCommentsPIsAndDataAttributes.

    13. + +

  13. If configuration["attributes"] exists and configuration["dataAttributes"] does not exist, then set it to allowCommentsPIsAndDataAttributes.

    14. +
+
+ +
+

To canonicalize a sanitizer list list:

+ +
    +

  1. Let newList be « ».

    2. + +

  2. For each item in list, append the result of canonicalizing item to newList.

    3. + +

  3. Return newList.

    4. +
+
+ +
+

To canonicalize a processing instruction list list:

+ +
    +

  1. Let newList be « ».

    2. + +

  2. For each item in list, append the result of canonicalizing item to newList.

    3. + +

  3. Return newList.

    4. +
+
+ +
+

To canonicalize a processing instruction given a SanitizerPI + pi:

+ +
    +

  1. If pi is a DOMString, then return «[ "target" → pi ]».

    2. + +

  2. Assert: pi is a dictionary and pi["target"] exists.

    3. + +

  3. Return «[ "target" → + pi["target"] + ]».

    4. +
+
+ +
+

To canonicalize a sanitizer name given a DOMString or dictionary name, and a default namespace + defaultNamespace (default null):

+ +
    +

  1. If name is a DOMString, then return «[ + "name" → name, "namespace" → defaultNamespace ]».

    2. + +

  2. Assert: name is a dictionary and both name["name"] and + name["namespace"] exist.

    3. + +

  3. If name["namespace"] is the empty string, then set it to null.

    4. + +

  4. Return «[ "name" → name["name"], "namespace" → name["namespace"] + ]».

    5. +
+
+ +
+

To canonicalize a sanitizer element given a SanitizerElement + element:

+ +
    +

  1. Return the result of canonicalizing + element with the HTML namespace as the default namespace.

    2. +
+
+ +
+

To canonicalize a sanitizer element list list:

+ +
    +

  1. Let newList be « ».

    2. + +

  2. For each item in list, append the result of canonicalizing item to newList.

    3. + +

  3. Return newList.

    4. +
+
+ +
+

To find the canonicalized intersection + of lists A and B:

+ +
    +

  1. Let setA be « ».

    + +

  2. Let setB be « ».

    + +

  3. For each entry of A, append the result of canonicalizing entry to setA.

    4. + +

  4. For each entry of B, append the result of canonicalizing entry to setB.

    5. + +

  5. Return the intersection of setA and + setB.

    6. +
+
+ +
+

The get() method + steps are:

+ +

Outside of the get() method, the order of + the Sanitizer's elements and attributes is unobservable. By explicitly sorting the + result of this method, we give implementations the opportunity to optimize by, for example, using + unordered sets internally.

+ +
    +

  1. Let config be this's configuration.

    2. + +

  2. Assert: config is valid.

    3. + +

  3. If config["elements"] exists:

    + +
      +
    1. +

      For each element of config["elements"]:

      + +
        +

      1. If element["attributes"] exists, then set element["attributes"] to the + result of sorting element["attributes"], with + compare sanitizer items.

        2. + +

      2. If element["removeAttributes"] + exists, then set element["removeAttributes"] + to the result of sorting element["removeAttributes"], + with compare sanitizer items.

        3. +
      +
      2. + +

    2. Set config["elements"] to + the result of sorting config["elements"], with compare sanitizer + items.

      3. +
    +
    4. + +
  4. +

    Otherwise:

    + +
      +

    1. Set config["removeElements"] to the result of sorting config["removeElements"], with compare + sanitizer items.

      2. +
    +
    5. + +

  5. If config["replaceWithChildrenElements"] + exists, then set config["replaceWithChildrenElements"] to + the result of sorting config["replaceWithChildrenElements"], + with compare sanitizer items.

    6. + +

  6. If config["processingInstructions"] exists, then set config["processingInstructions"] to the result + of sorting config["processingInstructions"], with + piA["target"] being + code unit less than piB["target"].

    7. + +
  7. +

    Otherwise:

    + +
      +

    1. Set config["removeProcessingInstructions"] + to the result of sorting config["removeProcessingInstructions"], + with piA["target"] + being code unit less than piB["target"].

      2. +
    +
    8. + +

  8. If config["attributes"] + exists, then set config["attributes"] to the result of sorting config["attributes"] given compare sanitizer + items.

    9. + +
  9. +

    Otherwise:

    + +
      +

    1. Set config["removeAttributes"] to the result of sorting config["removeAttributes"] given compare + sanitizer items.

      2. +
    +
    10. + +

  10. Return config.

    11. +
+
+ +
+

The allowElement(element) method steps + are:

+ +
    +

  1. Let configuration be this's configuration.

    2. + +

  2. Assert: configuration is valid.

    3. + +

  3. Set element to the result of canonicalizing element.

    4. + +

  4. If configuration["elements"] + exists:

    + +
      +

    1. Let modified be the result of removing + element from configuration["replaceWithChildrenElements"].

      2. + +
    2. +

      If configuration["attributes"] exists:

      + +
        +
      1. +

        If element["attributes"] exists:

        + +
          +

        1. Set element["attributes"] to the + result of creating a set from element["attributes"].

          2. + +

        2. Set element["attributes"] to the + difference of element["attributes"] and + configuration["attributes"].

          3. + +

        3. If configuration["dataAttributes"] is true, then remove all items item from element["attributes"] where + item is a custom data attribute.

          4. +
        +
        2. + +
      2. +

        If element["removeAttributes"] + exists:

        + +
          +

        1. Set element["removeAttributes"] + to the result of creating a set from + element["removeAttributes"].

          2. + +

        2. Set element["removeAttributes"] + to the intersection of + element["removeAttributes"] + and configuration["attributes"].

          3. +
        +
        3. +
      +
      3. + +
    3. +

      Otherwise:

      + +
        +

      1. If element["attributes"] exists:

        + +
          +

        1. Set element["attributes"] to the + result of creating a set from element["attributes"].

          2. + +

        2. Set element["attributes"] to the + difference of element["attributes"] and + element["removeAttributes"] + with default « ».

          3. + +

        3. Remove element["removeAttributes"].

          4. + +

        4. Set element["attributes"] to the + difference of element["attributes"] and + configuration["removeAttributes"].

          5. +
        +
        2. + +
      2. +

        If element["removeAttributes"] + exists:

        + +
          +

        1. Set element["removeAttributes"] + to the result of creating a set from + element["removeAttributes"].

          2. + +

        2. Set element["removeAttributes"] + to the difference of element["removeAttributes"] + and configuration["removeAttributes"].

          3. +
        +
        3. +
      +
      4. + +
    4. +

      If configuration["elements"] + does not contain element:

      + +
        +

      1. Append element to + configuration["elements"].

        2. + +

      2. Return true.

        3. +
      +
      5. + +

    5. Let currentElement be the item in configuration["elements"] whose name member is element's name member and whose namespace member is + element's namespace + member.

      6. + +

    6. If element is equal to currentElement, then return + modified.

      7. + +

    7. Remove element from + configuration["elements"].

      8. + +

    8. Append element to + configuration["elements"].

      9. + +

    9. Return true.

      10. +
    +
    5. + +
  5. +

    Otherwise:

    + +
      +

    1. If element["attributes"] exists or element["removeAttributes"] + with default « » is not empty, then return + false.

      2. + +

    2. Let modified be the result of removing + element from configuration["replaceWithChildrenElements"].

      3. + +

    3. If configuration["removeElements"] does not contain element, then return modified.

      4. + +

    4. Remove element from + configuration["removeElements"].

      5. + +

    5. Return true.

      6. +
    +
    6. +
+
+ +
+

The removeElement(element) method steps + are to return the result of removing + element from this's configuration.

+
+ +
+

The replaceElementWithChildren(element) + method steps are:

+ +
    +

  1. Let configuration be this's configuration.

    2. + +

  2. Assert: configuration is valid.

    3. + +

  3. Set element to the result of canonicalizing element.

    4. + +

  4. If the built-in non-replaceable elements list contains element, then return false.

    5. + +

  5. Let modified be the result of removing + element from configuration["elements"].

    6. + +

  6. If removing element from + configuration["removeElements"] is true, then set + modified to true.

    7. + +

  7. If configuration["replaceWithChildrenElements"] + does not contain element:

    + +
      +

    1. Append element to + configuration["replaceWithChildrenElements"].

      2. + +

    2. Return true.

      3. +
    +
    8. + +

  8. Return modified.

    9. +
+
+ +
+

The allowAttribute(attribute) method + steps are:

+ +
    +

  1. Let configuration be this's configuration.

    2. + +

  2. Assert: configuration is valid.

    3. + +

  3. Set attribute to the result of canonicalizing attribute.

    4. + +
  4. +

    If configuration["attributes"] exists:

    + +
      +

    1. If configuration["dataAttributes"] is true and + attribute is a custom data attribute, then return false.

      2. + +

    2. If configuration["attributes"] contains attribute, then return false.

      3. + +
    3. +

      If configuration["elements"] + exists:

      + +
        +
      1. +

        For each element in + configuration["elements"]:

        + +
          +

        1. If element["attributes"] with default « » contains attribute, then remove attribute from element["attributes"].

          2. +
        +
        2. +
      +
      4. + +

    4. Append attribute to + configuration["attributes"].

      5. + +

    5. Return true.

      6. +
    +
    5. + +
  5. +

    Otherwise:

    + +
      +

    1. If configuration["removeAttributes"] does not contain attribute, then return false.

      2. + +

    2. Remove attribute from + configuration["removeAttributes"].

      3. + +

    3. Return true.

      4. +
    +
    6. +
+
+ +
+

The removeAttribute(attribute) method + steps are to return the result of remove + an attribute with attribute and this's + configuration.

+
+ +
+

The setComments(allow) method steps + are:

+ +
    +

  1. Let configuration be this's configuration.

    2. + +

  2. Assert: configuration is valid.

    3. + +

  3. If configuration["comments"] + exists and is equal to allow, then return + false.

    4. + +

  4. Set configuration["comments"] to allow.

    5. + +

  5. Return true.

    6. +
+
+ +
+

The setDataAttributes(allow) method + steps are:

+ +
    +

  1. Let configuration be this's configuration.

    2. + +

  2. Assert: configuration is valid.

    3. + +

  3. If configuration["attributes"] does not exist, then return false.

    4. + +

  4. If configuration["dataAttributes"] exists and is equal to allow, then return false.

    5. + +
  5. +

    If allow is true:

    + +
      +
    1. +

      If configuration["elements"] + exists:

      + +
        +
      1. +

        For each element of + configuration["elements"]:

        + +
          +

        1. If element["attributes"] exists, then remove all items + item from element["attributes"] where + item is a custom data attribute.

          2. +
        +
        2. +
      +
      2. + +

    2. Remove all items item from + configuration["attributes"] + where item is a custom data attribute.

      3. +
    +
    6. + +

  6. Set configuration["dataAttributes"] to allow.

    7. + +

  7. Return true.

    8. +
+
+ +
+

The allowProcessingInstruction(pi) + method steps are:

+ +
    +

  1. Let configuration be this's configuration.

    2. + +

  2. Assert: configuration is valid.

    3. + +

  3. Set pi to the result of canonicalizing pi.

    4. + +
  4. +

    If configuration["processingInstructions"] exists:

    + +
      +

    1. If configuration["processingInstructions"] contains pi, then return false.

      2. + +

    2. Append pi to + configuration["processingInstructions"].

      3. + +

    3. Return true.

      4. +
    +
    5. + +
  5. +

    Otherwise:

    + +
      +
    1. +

      If configuration["removeProcessingInstructions"] + contains pi:

      + +
        +

      1. Remove pi from + configuration["removeProcessingInstructions"].

        2. + +

      2. Return true.

        3. +
      +
      2. + +

    2. Return false.

      3. +
    +
    6. +
+
+ +
+

The removeProcessingInstruction(pi) + method steps are:

+ +
    +

  1. Let configuration be this's configuration.

    2. + +

  2. Assert: configuration is valid.

    3. + +

  3. Set pi to the result of canonicalizing pi.

    4. + +
  4. +

    If configuration["processingInstructions"] exists:

    + +
      +
    1. +

      If configuration["processingInstructions"] contains pi:

      + +
        +

      1. Remove pi from + configuration["processingInstructions"].

        2. + +

      2. Return true.

        3. +
      +
      2. + +

    2. Return false.

      3. +
    +
    5. + +
  5. +

    Otherwise:

    + +
      +

    1. If configuration["removeProcessingInstructions"] + contains pi, then return false.

      2. + +

    2. Append pi to + configuration["removeProcessingInstructions"].

      3. + +

    3. Return true.

      4. +
    +
    6. +
+
+ +
+

The removeUnsafe() method steps are to return the + result of removing unsafe from this's + configuration.

+
+ +

Sanitizer configuration

+ + 
dictionary SanitizerElementNamespace {
+  required DOMString name;
+  DOMString? _namespace = "http://www.w3.org/1999/xhtml";
+};
+
+// Used by "elements"
+dictionary SanitizerElementNamespaceWithAttributes : SanitizerElementNamespace {
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+};
+
+dictionary SanitizerAttributeNamespace {
+  required DOMString name;
+  DOMString? _namespace = null;
+};
+
+dictionary SanitizerProcessingInstruction {
+  required DOMString target;
+};
+
+typedef (DOMString or SanitizerElementNamespace) SanitizerElement;
+typedef (DOMString or SanitizerElementNamespaceWithAttributes) SanitizerElementWithAttributes;
+typedef (DOMString or SanitizerProcessingInstruction) SanitizerPI;
+typedef (DOMString or SanitizerAttributeNamespace) SanitizerAttribute;
+
+dictionary SanitizerConfig {
+  sequence<SanitizerElementWithAttributes> elements;
+  sequence<SanitizerElement> removeElements;
+  sequence<SanitizerElement> replaceWithChildrenElements;
+
+  sequence<SanitizerPI> processingInstructions;
+  sequence<SanitizerPI> removeProcessingInstructions;
+
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+
+  boolean comments;
+  boolean dataAttributes;
+};
+ +

SanitizerElementNamespace, SanitizerAttributeNamespace, + SanitizerElementNamespaceWithAttributes, and + SanitizerProcessingInstruction dictionaries are considered equal when all of their + members are equal.

+ +

Equality should be defined in the infra spec instead. See issue #664.

+ +
Configuration invariants
+ + + +

Configurations can and ought to be modified by developers to suit their purposes. Options are + to write a new SanitizerConfig dictionary from scratch, to modify an existing + Sanitizer's configuration by using the modifier methods, or to get() an existing Sanitizer's + configuration as a dictionary and modify the dictionary and then create a new + Sanitizer with it.

+ +

An empty configuration allows everything (when called with the "unsafe" methods like setHTMLUnsafe()). A configuration "default" contains a + built-in safe default configuration. Note that "safe" and "unsafe" sanitizer methods + have different defaults.

+ +

Not all configuration dictionaries are valid. A valid configuration avoids redundancy (like + specifying the same element to be allowed twice) and contradictions (like specifying an element to + be both removed and allowed.)

+ +

Several conditions need to hold for a configuration to be valid:

+ + + +

The elements element allow-list can also + specify allowing or removing attributes for a given element. This is meant to mirror this + standard's structure, which knows both global attributes as well as local attributes + that apply to a specific element. Global and local attributes can be mixed, but note that + ambiguous configurations where a particular attribute would be allowed by one list and forbidden + by another, are generally invalid.

+ + + + + + + + + + + + + + + + + + + + + +
global attributesglobal removeAttributes
local attributesAn attribute is allowed if it matches either list. No duplicates are allowed.An attribute is only allowed if it's in the local allow list. No duplicate entries between + global remove and local allow lists are allowed. Note that the global remove list has no + function for this particular element, but can apply to other elements that do not have a + local allow list.
local removeAttributesAn attribute is allowed if it's in the global allow-list, but not in the local remove-list. + Local remove has to be a subset of the global allow lists.An attribute is allowed if it is in neither list. No duplicate entries between global + remove and local remove lists are allowed.
+ +

Please note the asymmetry where mostly no duplicates between global and per-element lists are + permitted, but in the case of a global allow-list and a per-element remove-list the latter has to + be a subset of the former. An excerpt of the table above, only focusing on duplicates, is as + follows:

+ + + + + + + + + + + + + + + + + + + + + +
global attributesglobal removeAttributes
local attributesNo duplicates are allowed.No duplicates are allowed.
local removeAttributesLocal remove has to be a subset of the global allow lists.No duplicates are allowed.
+ +

The dataAttributes setting allows + custom data attributes. The rules above easily extends + to custom data attributes if one considers dataAttributes to be an allow-list:

+ + + + + + + + + + + + + + + + + + +
global attributes and dataAttributes set
local attributesAll custom data attributes are allowed. No + custom data attributes can be listed in any + allow-list, as that would mean a duplicate entry.
local removeAttributesA custom data attribute is allowed, unless it's + listed in the local remove-list. No custom data + attribute can be listed in the global allow-list, as that would mean a duplicate + entry.
+ +

Putting these rules in words:

+ + + +
+ +

Sanitization algorithms

+ +
+

To set and filter HTML, given an Element or + DocumentFragment target, an Element + contextElement, a string html, a dictionary options, + and a boolean safe:

+ +
    +
  1. +

    If all of the following are true:

    + +
      +

    • safe;

      • + +

    • contextElement's local name + is "script"; and

      • + +

    • contextElement's namespace is + the HTML namespace or the SVG namespace,

      • +
    + +

    then return.

    +
    2. + +

  2. Let sanitizer be the result of calling getting a sanitizer from options given safe.

    3. + +

  3. Let newChildren be the result of parsing a fragment given contextElement, html, and + true.

    4. + +

  4. Let fragment be a new DocumentFragment whose node + document is contextElement's node document.

    5. + +

  5. For each node in newChildren, + append node to fragment.

    6. + +

  6. Sanitize fragment given sanitizer and + safe.

    7. + +

  7. Replace all with fragment within + target.

    8. +
+
+ +
+

To get a sanitizer instance from options from a dictionary options with a + boolean safe:

+ +
    +

  1. Let sanitizerSpec be "default".

    2. + +

  2. If options["sanitizer"] + exists, then set sanitizerSpec to + options["sanitizer"].

    3. + +

  3. Assert: sanitizerSpec is either a Sanitizer instance, + a SanitizerPresets member, or a SanitizerConfig dictionary.

    4. + +
  4. +

    If sanitizerSpec is a string:

    + +
      +

    1. Assert: sanitizerSpec is "default".

      2. + +

    2. Set sanitizerSpec to the built-in safe default + configuration.

      3. +
    +
    5. + +
  5. +

    If sanitizerSpec is a dictionary:

    + +
      +

    1. Let sanitizer be a new Sanitizer object.

      2. + +

    2. Let allowCommentsAndDataAttributes be true if safe is false; false + otherwise.

      3. + +

    3. Configure sanitizer given + sanitizerSpec and allowCommentsAndDataAttributes.

      4. + +

    4. Set sanitizerSpec to sanitizer.

      5. +
    +
    6. + +

  6. Return sanitizerSpec.

    7. +
+
+ +
+

To sanitize a Node node with a Sanitizer + sanitizer and a boolean safe:

+ +
    +

  1. Let configuration be sanitizer's + configuration.

    2. + +

  2. Assert: configuration is valid.

    3. + +

  3. If safe is true, then remove unsafe from + configuration.

    4. + +

  4. Run the inner sanitize steps given node, configuration, + and safe.

    5. +
+
+ +
+

To perform the inner sanitize steps given a Node node, a + SanitizerConfig configuration, and a boolean + handleJavascriptNavigationUrls:

+ +
    +
  1. +

    For each child of node's children:

    + +
      +

    1. Assert: child is a Text, Comment, + Element, ProcessingInstruction, or DocumentType + node.

      2. + +

    2. If child is a DocumentType or Text node, then + continue.

      3. + +
    3. +

      If child is a Comment node:

      + +
        +

      1. If configuration["comments"] is not true, then remove child.

        2. + +

      2. Continue.

        3. +
      +
      4. + +
    4. +

      If child is a ProcessingInstruction node:

      + +
        +

      1. Let piTarget be child's target.

        2. + +
      2. +

        If configuration["processingInstructions"] exists:

        + +
          +

        1. If configuration["processingInstructions"] does + not contain piTarget, then remove child.

          2. +
        +
        3. + +
      3. +

        Otherwise:

        + +
          +

        1. If configuration["removeProcessingInstructions"] + contains piTarget, then remove child.

          2. +
        +
        4. +
      +
      5. + +
    5. +

      Otherwise:

      + +
        +

      1. Let elementName be a SanitizerElementNamespace with + child's local name and namespace.

        2. + +

      2. If configuration["replaceWithChildrenElements"] + exists and configuration["replaceWithChildrenElements"] + contains elementName:

        + +
          +

        1. Assert: node is not a Document.

          2. + +

        2. Run the inner sanitize steps given child, + configuration, and handleJavascriptNavigationUrls.

          3. + +

        3. Let fragment be a new DocumentFragment whose node + document is node's node document.

          4. + +

        4. For each innerChild of + child's children, append innerChild to + fragment.

          5. + +

        5. Replace child with + fragment within node. Assert that this did not + throw.

          6. + +

        6. Continue.

          7. +
        +
        3. + +
      3. +

        If configuration["elements"] exists:

        + +
          +

        1. If configuration["elements"] does not contain elementName, then remove child and + continue.

          2. +
        +
        4. + +
      4. +

        Otherwise:

        + +
          +

        1. If configuration["removeElements"] contains elementName, then remove child and + continue.

          2. +
        +
        5. + +

      5. If elementName["name"] is "template" and + elementName["namespace"] is the HTML + namespace, then run the inner sanitize steps given child's + template contents, configuration, and + handleJavascriptNavigationUrls.

        6. + +

      6. If child is a shadow host, then run the inner sanitize + steps given child's shadow root, configuration and + handleJavascriptNavigationUrls.

        7. + +

      7. Let elementWithLocalAttributes be «[ ]».

        8. + +

      8. If configuration["elements"] exists and configuration["elements"] contains elementName, then set + elementWithLocalAttributes to configuration["elements"][elementName].

        9. + +
      9. +

        For each attribute in child's + attribute list:

        + +
          +

        1. Let attrName be a SanitizerAttributeNamespace with + attribute's local name and + namespace.

          2. + +

        2. If elementWithLocalAttributes["removeAttributes"] + exists and elementWithLocalAttributes["removeAttributes"] + contains attrName, then remove attribute.

          3. + +
        3. +

          Otherwise, if configuration["attributes"] exists:

          + +
            +

          1. If configuration["attributes"] does not contain attrName and + elementWithLocalAttributes["attributes"] with default « » does not contain attrName, and if "data-" is + not a code unit prefix of attribute's local name or attribute's namespace is not null or + configuration["dataAttributes"] is not true, then + remove + attribute.

            2. +
          +
          4. + +
        4. +

          Otherwise:

          + +
            +

          1. If elementWithLocalAttributes["attributes"] exists and elementWithLocalAttributes["attributes"] does + not contain attrName, then remove attribute.

            2. + +

          2. Otherwise, if configuration["removeAttributes"] contains attrName, then remove attribute.

            3. +
          +
          5. + +
        5. +

          If handleJavascriptNavigationUrls is true:

          + +
            +

          1. If the pair (elementName, attrName) matches an entry in the + built-in navigating URL attributes list, and if attribute + contains a javascript: URL, then remove attribute.

            2. + +

          2. If child's namespace is + the MathML Namespace, attribute's local name is "href", + and attribute's namespace is + null or the XLink namespace, and attribute contains a + javascript: URL, then remove attribute.

            3. + +

          3. If the built-in animating URL attributes list contains the pair (elementName, attrName), and + attribute's value is "href" or "xlink:href", then remove attribute.

            4. +
          +
          6. +
        +
        10. + +

      10. Run the inner sanitize steps given child, + configuration, and handleJavascriptNavigationUrls.

        11. +
      +
      6. +
    +
    2. +
+
+ +
+

To determine whether an attribute attribute contains a javascript: + URL:

+ +
    +

  1. Let url be the result of running the basic URL parser on + attribute's value.

    2. + +

  2. If url is failure, then return false.

    3. + +

  3. Return true if url's scheme is "javascript", and false otherwise.

    4. +
+
+ +
+

To remove an element + element from a SanitizerConfig configuration:

+ +
    +

  1. Assert: configuration is valid.

    2. + +

  2. Set element to the result of canonicalizing element.

    3. + +

  3. Let modified be the result of removing + element from configuration["replaceWithChildrenElements"].

    4. + +
  4. +

    If configuration["elements"] + exists:

    + +
      +
    1. +

      If configuration["elements"] + contains element:

      + +
        +

      1. Remove element from + configuration["elements"].

        2. + +

      2. Return true.

        3. +
      +
      2. + +

    2. Return modified.

      3. +
    +
    5. + +
  5. +

    Otherwise:

    + +
      +

    1. If configuration["removeElements"] contains element, then return modified.

      2. + +

    2. Append element to + configuration["removeElements"].

      3. + +

    3. Return true.

      4. +
    +
    6. +
+
+ +
+

To remove an attribute + attribute from a SanitizerConfig configuration:

+ +
    +

  1. Assert: configuration is valid.

    2. + +

  2. Set attribute to the result of canonicalizing attribute.

    3. + +
  3. +

    If configuration["attributes"] exists:

    + +
      +

    1. Let modified be the result of removing + attribute from configuration["attributes"].

      2. + +
    2. +

      If configuration["elements"] + exists:

      + +
        +
      1. +

        For each element of + configuration["elements"]:

        + +
          +
        1. +

          If element["attributes"] with default « » contains attribute:

          + +
            +

          1. Set modified to true.

            2. + +

          2. Remove attribute from + element["attributes"].

            3. +
          +
          2. + +
        2. +

          If element["removeAttributes"] + with default « » contains attribute:

          + +
            +

          1. Assert: modified is true.

            2. + +

          2. Remove attribute from + element["removeAttributes"].

            3. +
          +
          3. +
        +
        2. +
      +
      3. + +

    3. Return modified.

      4. +
    +
    4. + +
  4. +

    Otherwise:

    + +
      +

    1. If configuration["removeAttributes"] contains attribute, then return false.

      2. + +
    2. +

      If configuration["elements"] + exists:

      + +
        +
      1. +

        For each element in + configuration["elements"]:

        + +
          +

        1. If element["attributes"] with default « » contains attribute, then remove attribute from element["attributes"].

          2. + +

        2. If element["removeAttributes"] + with default « » contains attribute, then remove attribute from element["removeAttributes"].

          3. +
        +
        2. +
      +
      3. + +

    3. Append attribute to + configuration["removeAttributes"].

      4. + +

    4. Return true.

      5. +
    +
    5. +
+
+ +
+

To remove unsafe from a SanitizerConfig configuration:

+ +
    +

  1. Assert: configuration is valid.

    2. + +

  2. Let result be false.

    3. + +
  3. +

    For each element in built-in safe + baseline configuration["removeElements"]:

    + +
      +

    1. If removing + element from configuration is true, then set result to + true.

      2. +
    +
    4. + +
  4. +

    For each attribute in built-in safe + baseline configuration["removeAttributes"]:

    + +
      +

    1. If removing + attribute from configuration is true, then set result to + true.

      2. +
    +
    5. + +
  5. +

    For each attribute that is an event handler content attribute:

    + +
      +

    1. If removing + attribute from configuration is true, then set result to + true.

      2. +
    +
    6. + +

  6. Return result.

    7. +
+
+ +
+

To compare sanitizer items itemA and itemB:

+ +
    +

  1. Let namespaceA be itemA["namespace"].

    2. + +

  2. Let namespaceB be itemB["namespace"].

    3. + +
  3. +

    If namespaceA is null:

    + +
      +

    1. If namespaceB is not null, then return true.

      2. +
    +
    4. + +
  4. +

    Otherwise:

    + +
      +

    1. If namespaceB is null, then return false.

      2. + +

    2. If namespaceA is code unit less than namespaceB, then + return true.

      3. + +

    3. If namespaceA is not namespaceB, then return false.

      4. +
    +
    5. + +

  5. If itemA["name"] is + code unit less than itemB["name"], then return true.

    6. + +

  6. Return false.

    7. +
+
+ +
+

To canonicalize a + SanitizerElementWithAttributes element:

+ +
    +

  1. Let result be the result of canonicalizing element.

    2. + +
  2. +

    If element is a dictionary:

    + +
      +

    1. If element["attributes"] exists, then set result["attributes"] to the + result of canonicalizing + element["attributes"].

      2. + +

    2. If element["removeAttributes"] + exists, then set result["removeAttributes"] + to the result of canonicalizing + element["removeAttributes"].

      3. +
    +
    3. + +

  3. If neither result["attributes"] nor + result["removeAttributes"] + exists, then set result["removeAttributes"] + to an empty list.

    4. + +

  4. Return result.

    5. +
+
+ +
+

To determine whether a canonical SanitizerConfig config is valid:

+ +

It's expected that the configuration being passed in has previously been run + through the canonicalize the configuration steps. We will simply assert conditions + that that algorithm is guaranteed to hold.

+ +
    +

  1. Assert: config["elements"] exists + or config["removeElements"] + exists.

    2. + +

  2. If config["elements"] exists and config["removeElements"] exists, then return false.

    3. + +

  3. Assert: Either config["processingInstructions"] exists or config["removeProcessingInstructions"] + exists.

    4. + +

  4. If config["processingInstructions"] exists and config["removeProcessingInstructions"] + exists, then return false.

    5. + +

  5. Assert: Either config["attributes"] exists or config["removeAttributes"] exists.

    6. + +

  6. If config["attributes"] + exists and config["removeAttributes"] exists, then return false.

    7. + +

  7. Assert: All SanitizerElementNamespaceWithAttributes, + SanitizerElementNamespace, SanitizerProcessingInstruction, and + SanitizerAttributeNamespace items in config are canonical, meaning they + have been run through canonicalizing, as + appropriate.

    8. + +
  8. +

    If config["elements"] exists:

    + +
      +

    1. If config["elements"] + has duplicates, then return false.

      2. +
    +
    9. + +
  9. +

    Otherwise:

    + +
      +

    1. If config["removeElements"] has duplicates, then return false.

      2. +
    +
    10. + +

  10. If config["replaceWithChildrenElements"] + exists and has + duplicates, then return false.

    11. + +
  11. +

    If config["processingInstructions"] exists:

    + +
      +

    1. If config["processingInstructions"] has duplicates, then return false.

      2. +
    +
    12. + +
  12. +

    Otherwise:

    + +
      +

    1. If config["removeProcessingInstructions"] + has duplicates, then return false.

      2. +
    +
    13. + +
  13. +

    If config["attributes"] exists:

    + +
      +

    1. If config["attributes"] + has duplicates, then return false.

      2. +
    +
    14. + +
  14. +

    Otherwise:

    + +
      +

    1. If config["removeAttributes"] has duplicates, then return false.

      2. +
    +
    15. + +
  15. +

    If config["replaceWithChildrenElements"] + exists:

    + +
      +
    1. +

      For each element of config["replaceWithChildrenElements"]:

      + +
        +

      1. If the built-in non-replaceable elements list contains element, then return false.

        2. +
      +
      2. + +
    2. +

      If config["elements"] exists:

      + +
        +

      1. If the intersection of + config["elements"] and + config["replaceWithChildrenElements"] + is not empty, then return false.

        2. +
      +
      3. + +
    3. +

      Otherwise:

      + +
        +

      1. If the intersection of + config["removeElements"] + and config["replaceWithChildrenElements"] + is not empty, then return false.

        2. +
      +
      4. +
    +
    16. + +
  16. +

    If config["attributes"] exists:

    + +
      +

    1. Assert: config["dataAttributes"] exists.

      2. + +
    2. +

      If config["elements"] exists:

      + +
        +
      1. +

        For each element of + config["elements"]:

        + +
          +

        1. If element["attributes"] exists and element["attributes"] has duplicates, then return false.

          2. + +

        2. If element["removeAttributes"] + exists and element["removeAttributes"] + has duplicates, then return false.

          3. + +

        3. If the intersection of + config["attributes"] and + element["attributes"] with default « » is not empty, then return false.

          4. + +

        4. If element["removeAttributes"] + with default « » is not a subset of config["attributes"], then return false.

          5. + +

        5. If config["dataAttributes"] is true and + element["attributes"] + contains a custom data attribute, then return false.

          6. +
        +
        2. +
      +
      3. + +

    3. If config["dataAttributes"] is true and + config["attributes"] contains a + custom data attribute, then return false.

      4. +
    +
    17. + +
  17. +

    Otherwise:

    + +
      +
    1. +

      If config["elements"] exists:

      + +
        +
      1. +

        For each element of + config["elements"]:

        + +
          +

        1. If element["attributes"] exists and element["removeAttributes"] + exists, then return false.

          2. + +

        2. If element["attributes"] exists and element["attributes"] has duplicates, then return false.

          3. + +

        3. If element["removeAttributes"] + exists and element["removeAttributes"] + has duplicates, then return false.

          4. + +

        4. If the intersection of + config["removeAttributes"] and + element["attributes"] with default « » is not empty, then return false.

          5. + +

        5. If the intersection of + config["removeAttributes"] and + element["removeAttributes"] + with default « » is not empty, then return + false.

          6. +
        +
        2. +
      +
      2. + +

    2. If config["dataAttributes"] exists, then return false.

      3. +
    +
    18. + +

  18. Return true.

    19. +
+
+ +

Sanitization constants

+ +

An element's sanitization category can be one of the following:

+ +
+
Default
+
The element is included in the default SanitizerConfig.
+ +
Unsafe
+
The element can result in XSS. (Such elements are preserved by setHTMLUnsafe() or parseHTMLUnsafe(), and removed by setHTML(), parseHTML(), + and removeUnsafe().)
+ +
Uncategorized
+
The element is neither removed nor included by default, but can still be added to a + SanitizerConfig.
+
+ +

The built-in safe baseline configuration is a SanitizerConfig. Its + removeElements list consists of all HTML + elements normatively marked as Unsafe within their + individual definitions, along with the obsolete frame element, and the SVG + script and SVG use elements, and its removeAttributes list is empty.

+ +

Event handler content attributes are automatically removed by the remove + unsafe algorithm during safe sanitization, so the effective baseline behaves as if they + were included in the removeAttributes + list.

+ +

The built-in safe default configuration is a SanitizerConfig whose + members are initialized as follows:

+ +
+
processingInstructions
+
« »
+ +
attributes
+
+ A list consisting of: +
    +
  • dir
    • +
  • lang
    • +
  • title
    • +
  • alignment-baseline
    • +
  • baseline-shift
    • +
  • clip-path
    • +
  • clip-rule
    • +
  • color
    • +
  • color-interpolation
    • +
  • cursor
    • +
  • direction
    • +
  • display
    • +
  • displaystyle
    • +
  • dominant-baseline
    • +
  • fill
    • +
  • fill-opacity
    • +
  • fill-rule
    • +
  • font-family
    • +
  • font-size
    • +
  • font-size-adjust
    • +
  • font-stretch
    • +
  • font-style
    • +
  • font-variant
    • +
  • font-weight
    • +
  • letter-spacing
    • +
  • marker-end
    • +
  • marker-mid
    • +
  • marker-start
    • +
  • mathbackground
    • +
  • mathcolor
    • +
  • mathsize
    • +
  • opacity
    • +
  • paint-order
    • +
  • pointer-events
    • +
  • scriptlevel
    • +
  • shape-rendering
    • +
  • stop-color
    • +
  • stop-opacity
    • +
  • stroke
    • +
  • stroke-dasharray
    • +
  • stroke-dashoffset
    • +
  • stroke-linecap
    • +
  • stroke-linejoin
    • +
  • stroke-miterlimit
    • +
  • stroke-opacity
    • +
  • stroke-width
    • +
  • text-anchor
    • +
  • text-decoration
    • +
  • text-overflow
    • +
  • text-rendering
    • +
  • transform
    • +
  • transform-origin
    • +
  • unicode-bidi
    • +
  • vector-effect
    • +
  • visibility
    • +
  • white-space
    • +
  • word-spacing
    • +
  • writing-mode
    • +
+
+ +
comments
+
false
+ +
dataAttributes
+
false
+ +
elements
+
All HTML elements normatively categorized as Default within their individual definitions, alongside + the MathML and SVG elements listed in the table below. Attributes included in those definitions + are included in each element's respective attributes list.
+
+ +

The following table lists the MathML and SVG elements that are categorized as Default in the built-in safe default + configuration, represented as a list of + SanitizerElementNamespaceWithAttributes dictionaries. For each row in the table, the + "Element" column corresponds to the name + member, the "Namespace" column corresponds to the namespace member, and the "Allowed + attributes" column corresponds to the attributes member (where + each listed attribute is represented as a SanitizerAttribute in the sequence):

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ElementNamespaceAllowed attributes
mathMathML
merrorMathML
mfracMathML
miMathML
mmultiscriptsMathML
mnMathML
moMathMLfence, form, largeop, lspace, maxsize, minsize, movablelimits, rspace, separator, stretchy, symmetric
moverMathMLaccent
mpaddedMathMLdepth, height, lspace, voffset, width
mphantomMathML
mprescriptsMathML
mrootMathML
mrowMathML
msMathML
mspaceMathMLdepth, height, width
msqrtMathML
mstyleMathML
msubMathML
msubsupMathML
msupMathML
mtableMathML
mtdMathMLcolumnspan, rowspan
mtextMathML
mtrMathML
munderMathMLaccentunder
munderoverMathMLaccent, accentunder
semanticsMathML
aSVGhref, hreflang, type
circleSVGcx, cy, pathLength, r
defsSVG
descSVG
ellipseSVGcx, cy, pathLength, rx, ry
foreignObjectSVGheight, width, x, y
gSVG
lineSVGpathLength, x1, x2, y1, y2
markerSVGmarkerHeight, markerUnits, markerWidth, orient, preserveAspectRatio, refX, refY, viewBox
metadataSVG
pathSVGd, pathLength
polygonSVGpathLength, points
polylineSVGpathLength, points
rectSVGheight, pathLength, rx, ry, width, x, y
svgSVGheight, preserveAspectRatio, viewBox, width, x, y
textSVGdx, dy, lengthAdjust, rotate, textLength, x, y
textPathSVGlengthAdjust, method, path, side, spacing, startOffset, textLength
titleSVG
tspanSVGdx, dy, lengthAdjust, rotate, textLength, x, y
+ +

The built-in navigating URL attributes list corresponds to all HTML elements marked + with navigating URL attributes in their normative definitions, as well as the + element-attribute pairs represented in the following table. For each row in the table, the element + corresponds to a SanitizerElementNamespace whose name member is given by the "Element" column + and whose namespace member is given + by the "Element namespace" column; and the attribute corresponds to a + SanitizerAttributeNamespace whose name member is given by the "Attribute" + column and whose namespace member + is given by the "Attribute namespace" column:

+ + + + + + + +
Element + Element namespace + Attribute + Attribute namespace +
a + SVG + href + no namespace +
a + SVG + href + XLink +
+ +

The built-in animating URL attributes list is the list of element-attribute pairs + represented by the following table. For each row in the table, the element corresponds to a + SanitizerElementNamespace whose name member is given by the "Element" column + and whose namespace member is given + by the "Element namespace" column; and the attribute corresponds to a + SanitizerAttributeNamespace whose name member is given by the "Attribute" + column and whose namespace member + is null:

+ + + + + + + + +
Element + Element namespace + Attribute +
animate + SVG + attributeName +
animateTransform + SVG + attributeName +
set + SVG + attributeName +
+ +

The built-in non-replaceable elements list contains elements that must not be + replaced with their children, as doing so can lead to re-parsing issues or an invalid node tree. + It is the following list of SanitizerElementNamespace dictionaries, represented by + the table below. For each row in the table, the "Element" column corresponds to the name member, and the "Element namespace" column + corresponds to the namespace + member:

+ + + + + + + + +
Element + Element namespace +
html + HTML +
svg + SVG +
math + MathML +
+
+ +

Security considerations

+ + + +

The Sanitizer API is intended to prevent DOM-based cross-site scripting by traversing supplied + HTML content and removing elements and attributes according to a configuration. By design, the + setHTML() and parseHTML() methods remove script-capable markup regardless of the + configuration supplied; if any configuration could preserve such markup through these methods, + that would be a bug.

+ +

However, there are security issues that the Sanitizer API cannot prevent. The following + sections describe them.

+ +
Server-side reflected and stored XSS
+ + + +

The Sanitizer API operates solely in the DOM and adds a capability to traverse and filter an + existing DocumentFragment. The Sanitizer API does not address server-side reflected + or stored XSS.

+ +
DOM clobbering
+ + + +

DOM clobbering describes an attack in which malicious HTML confuses an application by using + id or name attributes such that DOM + properties, such as the children property of an HTML + element, are shadowed by malicious content.

+ +

The Sanitizer API does not protect against DOM clobbering attacks by default, but can be + configured to remove id and name + attributes.

+ +
XSS with script gadgets
+ + + +

Script gadgets are a technique in which an attacker uses existing application code from popular + JavaScript libraries to cause their own code to execute. This is often done by injecting + innocent-looking code or seemingly inert DOM nodes that are only parsed and interpreted by a + framework which then performs the execution of JavaScript based on that input.

+ +

The Sanitizer API cannot prevent these attacks. Instead, it relies on authors to explicitly + allow unknown elements in general, and additionally to explicitly allow attributes, elements, and + markup commonly used for templating and framework-specific code, such as data-* and slot attributes and + elements like slot and template. These restrictions are not exhaustive + and authors are encouraged to examine their third party libraries for this behavior.

+ +
Mutation XSS
+ + + +

Mutation XSS or mXSS describes an attack that exploits cases where the parsed DOM structure is + not the same after serializing and parsing again, to bypass sanitization that happens before + serialization. An example for carrying out such an attack is by relying on the change of parsing + behavior for foreign content or mis-nested tags.

+ +

The Sanitizer API offers only functions that turn a string into a node tree. The context is + supplied implicitly by all sanitizer functions: setHTML() uses the current element; Document.parseHTML() creates a new document. Therefore Sanitizer API + is not directly affected by mutation XSS.

+ +

If a developer were to retrieve a sanitized node tree as a string, e.g. via innerHTML, and to then parse it again then mutation XSS can + occur. This practice is strongly discouraged. If processing or passing of HTML as a string is + necessary after all, then any string is to be considered untrusted and re-sanitized when inserted + into the DOM. In other words, a sanitized and then serialized HTML tree can no longer be + considered sanitized. A more complete treatment of mXSS can be found in MXSS.

+

Timers

The setTimeout() and [MULTIPLEBUFFERING]

(Non-normative) Multiple buffering. Wikipedia.
+
[MXSS]
+
mXSS Attacks: Attacking well-secured Web-Applications by using innerHTML Mutations, M. Heiderich, J. Schwenk, T. Frosch, J. Magazinius, and E. Z. Yang. In Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security (CCS '13), Berlin, Germany, 2013.
+
[NAVIGATIONTIMING]
Navigation Timing, Y. Weiss. W3C.