Skip to content

Remove .tentative from setHTMLUnsafe-runScripts test#60234

Open
noamr wants to merge 3 commits into
masterfrom
untent-runScripts
Open

Remove .tentative from setHTMLUnsafe-runScripts test#60234
noamr wants to merge 3 commits into
masterfrom
untent-runScripts

Conversation

@noamr
Copy link
Copy Markdown
Contributor

@noamr noamr commented May 28, 2026

Copy link
Copy Markdown
Member

@annevk annevk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we need more coverage. E.g.,

  • unsafe + sanitizer that removes the script element.
  • multiple script and style elements with the script elements trying to observe the order in which state gets initialized and things are run (cc @domfarolino)

We should also add a test that ensures Document.parseHTMLUnsafe and Element.prototype.setHTML don't look at this member (throw if the binding layer attempts to get it).

@hsivonen might also have some ideas for this, perhaps?

@noamr
Copy link
Copy Markdown
Contributor Author

noamr commented May 28, 2026

I think we need more coverage. E.g.,

  • unsafe + sanitizer that removes the script element.
  • multiple script and style elements with the script elements trying to observe the order in which state gets initialized and things are run (cc @domfarolino)

We should also add a test that ensures Document.parseHTMLUnsafe and Element.prototype.setHTML don't look at this member (throw if the binding layer attempts to get it).

@hsivonen might also have some ideas for this, perhaps?

Added tests to that effect. Happy to add more coverage that people think would be useful.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants