diff --git a/source b/source index 631f655f890..4f99c6fa57f 100644 --- a/source +++ b/source @@ -4788,7 +4788,8 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • TrustedScript
  • data
  • TrustedScriptURL
    • -
  • Get Trusted Type compliant string
    • +
  • get trusted type compliant string
    • +
  • should sink type mismatch violation be blocked by content security policy?
    • @@ -35426,7 +35427,7 @@ interface HTMLIFrameElement : HTMLElement {

    1. Let compliantString be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, the given value, "HTMLIFrameElement srcdoc", and "script".

      2. @@ -123378,7 +123379,7 @@ document.body.appendChild(frame)

    2. If isTrusted is false, set string to the result of invoking the - Get Trusted Type compliant string algorithm with + get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, string, sink, and "script".

      3. @@ -123478,7 +123479,7 @@ document.body.appendChild(frame)

      DOM parsing and serialization APIs

      - 
      partial interface Element {
+  
      partial interface Element {
   [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
   DOMString getHTML(optional GetHTMLOptions options = {});
 
@@ -123487,7 +123488,7 @@ document.body.appendChild(frame)
      
   [CEReactions] undefined insertAdjacentHTML(DOMString position, (TrustedHTML or DOMString) string);
 };
 
-partial interface ShadowRoot {
+partial interface ShadowRoot {
   [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
   DOMString getHTML(optional GetHTMLOptions options = {});
 
@@ -123567,7 +123568,7 @@ enum DOMParserSupportedType {
 
   
        
    
      1. Let compliantString be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedHTML, this's relevant global
    object, string, "DOMParser parseFromString", and "script".
        2. 
@@ -123713,7 +123714,7 @@ enum DOMParserSupportedType {
 
   
          
    
        1. Let compliantHTML be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedHTML, this's relevant global
    object, html, "Element setHTMLUnsafe", and "script".
          2. 
@@ -123733,7 +123734,7 @@ enum DOMParserSupportedType {
 
   
            
    
          1. Let compliantHTML be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedHTML, this's relevant global
    object, html, "ShadowRoot setHTMLUnsafe", and "script".
            2. 
@@ -123771,7 +123772,7 @@ enum DOMParserSupportedType {
 
   
              
    
            1. Let compliantHTML be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedHTML, this's relevant global
    object, html, "Document parseHTMLUnsafe", and "script".
              2. 
@@ -123946,7 +123947,7 @@ enum DOMParserSupportedType {
 
   
                
     
              1. Let compliantString be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedHTML, this's relevant global
     object, the given value, "Element innerHTML", and "script".
                2. 
@@ -123977,7 +123978,7 @@ enum DOMParserSupportedType {
 
   
                  
     
                1. Let compliantString be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedHTML, this's relevant global
     object, the given value, "ShadowRoot innerHTML", and "script".
                  2. 
@@ -124045,7 +124046,7 @@ enum DOMParserSupportedType {
 
   
                    
     
                  1. Let compliantString be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedHTML, this's relevant global
     object, the given value, "Element outerHTML", and "script".
                    2. 
@@ -124122,7 +124123,7 @@ enum DOMParserSupportedType {
 
   
                      
    
                    1. Let compliantString be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedHTML, this's relevant global
    object, string, "Element insertAdjacentHTML", and "script".
                      2. 
@@ -124357,6 +124358,109 @@ interface XMLSerializer {
 
   
 
+  
                      Patching
                      
+
+  
                      TODO: introduction, what's all this?
                      
+
+  
                      partial interface Element {
+  WritableStream streamHTMLUnsafe(optional StreamHTMLUnsafeOptions options = {});
+};
+
+partial interface ShadowRoot {
+  WritableStream streamHTMLUnsafe(optional StreamHTMLUnsafeOptions options = {});
+};
+
+dictionary StreamHTMLUnsafeOptions {
+  boolean runScripts = false;
+};
                      
+
+  
                      
+
+  
                      
+  
                      Element's streamHTMLUnsafe(options) method steps
+  are:
                      
+
+  
                        
+   
                      1. Let disposition be the result of invoking the should sink type mismatch violation be blocked by content security
+   policy? algorithm given this's relevant global object,
+   "Element streamHTMLUnsafe", "script", and "".
                        2. 
+
+   
                      2. If disposition is not "Allowed", throw a TypeError.
                        3. 
+
+   
                      3. Let context be this.
                        4. 
+
+   
                      4. Let writable be a new WritableStream.
                        5. 
+
+   
                      5. 
+    
                        Let parser be an HTML parser using the HTML fragment parsing
+    algorithm given context as context
+    where the input is delivered in chunks instead of a fixed string.
                        
+
+    
                        Refactor the fragment parser algorithm to really support being used in this way,
+    either as an object with an algorithm to feed the parser string chunks, or by making the
+    argument a readable which the parser reads from.
                        
+
+    
                        Check all the "is fragment parser" bits to see if something shouldn't apply.
                        
+   
                        6. 
+
+   
                      6. 
+    
                        Configure parser to insert nodes into context instead of into the
+    internal DocumentFragment.
                        
+
+    
                        This should be adjusted inside the parser, not from the outside.
                        
+   
                        7. 
+
+   
                      7. If options["runScripts"],
+   configure parser to not mark scripts as already executed.
                        8. 
+
+   
                      8. Return writable and continue running the remaining steps in parallel.
                        9. 
+
+   
                      9. 
+    
                        When writable is first locked to a writer, remove all child nodes of
+    context in tree order.
                        
+
+    
                        Is this is exactly the right timing for removing children? Is it correct to do nothing
+    the second time a writer is locked?
                        
+   
                        10. 
+
+   
                      10. 
+    
                        For every chunk that is written to writable:
                        
+
+    
                          
+     
                        1. Set input to the stringification of chunk. If this throws, abort
+     writable and abort these steps.
                          2. 
+
+     
                        2. Place the input into the input stream of parser.
                          3. 
+
+     
                        3. Let parser run until it has consumed all the characters just inserted into
+     the input stream.
                          4. 
+    
                        
+   
                        11. 
+  
                      
+  
                      
+
+  
                      
+   
                      Do a thing like this:
                      
+   
                      const response = await fetch('/fragments/something');
+const decoder = new TextDecoderStream();
+const writable = element.streamHTMLUnsafe();
+await response.body.pipeThrough(decoder).pipeTo(writable);
                      
+  
                      
+
+  
                      
+  
                      ShadowRoot's streamHTMLUnsafe(options) method steps
+  are:
                      
+
+  
                        
+   
                      1. TODO
                        2. 
+  
                      
+  
                      
+
+  
                      
+
   
                      Timers
                      
 
   
                      The setTimeout() and XMLSerializer {
          methodName.
                      
 
          
                    2. Set handler to the result of invoking the Get Trusted Type compliant string algorithm with
+         data-x="tt-getcompliantstring">get trusted type compliant string algorithm with
          TrustedScript, global,
          handler, sink, and "script".
                      3. 
         
                    
@@ -131081,7 +131185,7 @@ enum WorkerType { "classic", "module" };
 
   
                      
    
                    1. Let compliantScriptURL be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedScriptURL, this's relevant global
    object, scriptURL, "Worker constructor", and "script".
                      2. 
@@ -131206,7 +131310,7 @@ interface SharedWorker : EventTarget {
 
   
                        
    
                      1. Let compliantScriptURL be the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedScriptURL, this's relevant global
    object, scriptURL, "SharedWorker constructor", and
    "script".
                        2. 
@@ -131444,7 +131548,7 @@ interface SharedWorker : EventTarget {
 
     
                          
      
                        1. Append the result of invoking the Get Trusted Type compliant string algorithm with get trusted type compliant string algorithm with TrustedScriptURL, this's relevant global
      object, url, "WorkerGlobalScope importScripts", and
      "script" to urlStrings.
                          2.