From a287c9eea38e92fe1694f4272fd4969a46b01c5d Mon Sep 17 00:00:00 2001 From: Derek Greene Date: Wed, 4 Mar 2026 00:09:09 -0800 Subject: [PATCH 1/2] :recycle: Refactor: Fix grammatical error (#43333) Co-authored-by: Derek Greene --- files/en-us/web/api/range/createcontextualfragment/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/en-us/web/api/range/createcontextualfragment/index.md b/files/en-us/web/api/range/createcontextualfragment/index.md index 5e0e160e98ecd5d..18bf1dcfdfc5788 100644 --- a/files/en-us/web/api/range/createcontextualfragment/index.md +++ b/files/en-us/web/api/range/createcontextualfragment/index.md @@ -47,7 +47,7 @@ In the HTML case, if the context node would be `html`, for historical reasons th ### Security considerations The method does not perform any sanitization of the input to remove XSS-unsafe elements such as {{htmlelement("script")}}, or event handler content attributes. -If the input is provided by a user, and the returned {{domxref("DocumentFragment")}} is subsequently injected into the DOM, this method can be therefore become a vector for [cross-site scripting (XSS)](/en-US/docs/Web/Security/Attacks/XSS) attacks. +If the input is provided by a user, and the returned {{domxref("DocumentFragment")}} is subsequently injected into the DOM, this method can become a vector for [cross-site scripting (XSS)](/en-US/docs/Web/Security/Attacks/XSS) attacks. For example, the following code would inject the potentially dangerous user-provided string into the DOM. From f529eadda54e8a3ed37b7c9d2182be61ce666b6a Mon Sep 17 00:00:00 2001 From: Kurt Catti-Schmidt Date: Wed, 4 Mar 2026 00:36:37 -0800 Subject: [PATCH 2/2] Updates to `modulepreload` and `preload` to incorporate WHATWG changes for "style" and "json" (#42333) * Adding changes to link tag page * Update files/en-us/web/html/reference/elements/link/index.md Co-authored-by: Chris Mills * Update files/en-us/web/html/reference/elements/link/index.md Co-authored-by: Chris Mills * Adding script to modulepreload as= section * Removing extra and --------- Co-authored-by: Chris Mills --- .../reference/attributes/rel/modulepreload/index.md | 2 +- files/en-us/web/html/reference/elements/link/index.md | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/files/en-us/web/html/reference/attributes/rel/modulepreload/index.md b/files/en-us/web/html/reference/attributes/rel/modulepreload/index.md index 915093ac8f99ed3..d8ca99b3fb3fa25 100644 --- a/files/en-us/web/html/reference/attributes/rel/modulepreload/index.md +++ b/files/en-us/web/html/reference/attributes/rel/modulepreload/index.md @@ -21,7 +21,7 @@ If `crossorigin` is set to [`anonymous`](/en-US/docs/Web/HTML/Reference/Attribut If `crossorigin` is set to [`use-credentials`](/en-US/docs/Web/HTML/Reference/Attributes/crossorigin#use-credentials) then the credentials mode is [`include`](/en-US/docs/Web/API/Request/credentials#include), and user credentials for both single- and cross-origin requests. The [`as`](/en-US/docs/Web/HTML/Reference/Elements/link#as) attribute is optional for links with `rel="modulepreload"`, and defaults to `"script"`. -It can be set to `"script"` or any script-like destination, such as `"audioworklet"`, `"paintworklet"`, `"serviceworker"`, `"sharedworker"`, or `"worker"`. +It can be set to `"script"`, `"style"`, `"json"`, or any script-like destination, such as `"audioworklet"`, `"paintworklet"`, `"serviceworker"`, `"sharedworker"`, or `"worker"`. An [`Event`](/en-US/docs/Web/API/Event/Event) named "error" is fired on the element if any other destination is used. A browser _may_ additionally also choose to automatically fetch any dependencies of the module resource. diff --git a/files/en-us/web/html/reference/elements/link/index.md b/files/en-us/web/html/reference/elements/link/index.md index 5feb79d951e2ba7..5c6443e3387a724 100644 --- a/files/en-us/web/html/reference/elements/link/index.md +++ b/files/en-us/web/html/reference/elements/link/index.md @@ -142,6 +142,12 @@ This element includes the [global attributes](/en-US/docs/Web/HTML/Reference/Glo CSS *-image rules + + json + + modulepreload destinations. + + object <object> elements @@ -149,14 +155,14 @@ This element includes the [global attributes](/en-US/docs/Web/HTML/Reference/Glo script - <script> elements, Worker importScripts + <script> elements, Worker importScripts, and modulepreload destinations. style <link rel=stylesheet> elements, CSS - @import + @import and modulepreload destinations.