Skip to content
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .vscode/dictionaries/code-entities.txt
Original file line number Diff line number Diff line change
Expand Up @@ -392,6 +392,7 @@ mathbold
mathdbl
mathit
mathml
mathml.stixgeneral_operator_stretching.disabled
mathmlref
mathmono
mathrm
Expand Down
1 change: 1 addition & 0 deletions .vscode/dictionaries/proper-names.txt
Original file line number Diff line number Diff line change
Expand Up @@ -372,6 +372,7 @@ McLellan
McNally
McVerry
Megalosaurus
Menard
Mercure
Merkle
mfuji
Expand Down
3 changes: 3 additions & 0 deletions .vscode/dictionaries/terms-abbreviations.txt
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@ blocklists
blockquotes
bluify
BMFF
bolognaise
bootup
botmaster
BPPmaxKb
Expand Down Expand Up @@ -175,6 +176,7 @@ discardable
distros
DLRR
DLSR
DMARC
docshell
docshells
doctypes
Expand Down Expand Up @@ -792,6 +794,7 @@ TIPC
toggletips
toolkits
toolsets
TOTP
touchpads
touchpoint
touchpoints
Expand Down
18 changes: 8 additions & 10 deletions files/en-us/web/api/htmlscriptelement/text/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,7 @@ browser-compat: api.HTMLScriptElement.text
> See [Security considerations](#security_considerations) for more information.

The **`text`** property of the {{domxref("HTMLScriptElement")}} interface represents the inline text content of the script element.
It acts the same way as the {{domxref("HTMLScriptElement.textContent","textContent")}} property.

It reflects the `text` attribute of the {{HTMLElement("script")}} element.
It acts the same way as the {{domxref("Node.textContent","textContent")}} property.

## Value

Expand All @@ -37,10 +35,10 @@ Note that if the {{domxref('HTMLScriptElement/src','src')}} property is set the

### `text` vs `textContent` vs `innerText`

The `text` and {{domxref("HTMLScriptElement.textContent", "textContent")}} properties of `HTMLScriptElement` are equivalent: both can be set with a string or a `TrustedScript` type and both return a string representing the content of the script element.
The `text` and {{domxref("Node.textContent", "textContent")}} properties of `HTMLScriptElement` are equivalent: both can be set with a string or a `TrustedScript` type and both return a string representing the content of the script element.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think at least some of these changes are wrong, cc @hamishwillee

Copy link
Collaborator

@hamishwillee hamishwillee Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, yes none of these changes should be made in this document.

@Josh-Cena The existing docs are correct - the properties have been added to HTMLScriptElement as well. They should be coming through from BCD soon. I still have to add docs for textContent and innerText - they are different than in the parent interfaces in that they can be assigned (and may required) TrustedTypes.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, wasn't aware of it!

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to ask for care with changes like this. Typoes are usually clear-cut, but this isn't, and it was just chance that I happened to see the PR when I had been involved in the review last week. It would be really easy for this to slip in otherwise.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not just a typo fix PR; I send PRs that fix broken links and broken code twice every week. This is a broken link and I wasn't aware that it's supposed to exist, because there's no BCD (had there been, it would be filtered out by virtue of being in web-docs-backlog).

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not just a typo fix PR

I do understand that, that's why I'm asking for care. It's easy for cleanup PRs to introduce errors in the docs, because often the author and the reviewer weren't involved in the original, so don't have the context.

In this case it's obvious from the next sentence that the change doesn't make sense:

The text and textContent properties of HTMLScriptElement are equivalent: both can be set with a string or a TrustedScript type and both return a string representing the content of the script element. The main difference is that textContent is also defined on Node and can be used with other elements to set their content with a string.

...but when a reviewer is looking at a cleanup PR that spans multiple different bits of the docs, that they haven't seen before, it's really easy for a busy reviewer to semi-rubberstamp it: look at a broken link, see that the PR fixes it, approve the PR.

The main difference is that {{domxref("Node.textContent", "textContent")}} is also defined on {{domxref("Node")}} and can be used with other elements to set their content with a string.

{{domxref("HTMLScriptElement.innerText", "innerText")}} will generally set and execute the text in the same way as the other methods, but may return a slightly different value.
{{domxref("HTMLElement.innerText", "innerText")}} will generally set and execute the text in the same way as the other methods, but may return a slightly different value.
The reason for this is that this property is designed for getting the rendered text of a string of HTML markup.
When setting the value the text is treated as a text node, which normalizes the string as if it were visible text (collapsing spaces and converting `\n` to line breaks).
This does not change the execution of the text, but it does alter the text that is stored and returned.
Expand Down Expand Up @@ -81,12 +79,12 @@ For the purpose of this example we'll allow just exactly the script that we need

```js
const policy = trustedTypes.createPolicy("inline-script-policy", {
createScript: (input) => {
createScript(input) {
// Here specify what scripts are safe to allow
if (input === "const num = 10;\nconsole.log(num)") {
return input; // allow this exact script
}
throw new TypeError("Untrusted script blocked: " + input);
throw new TypeError(`Untrusted script blocked: ${input}`);
},
});
```
Expand Down Expand Up @@ -123,7 +121,7 @@ Note that in this case we're not using the policy to create trusted scripts (for

```js
// Set the text property
let el.text = "const num = 10;\nconsole.log(num)";
el.text = "const num = 10;\nconsole.log(num)";
console.log(el.text); // Output: "const num = 10;\nconsole.log(num);"
console.log(el.textContent); // Output: "const num = 10;\nconsole.log(num);"

Expand All @@ -143,5 +141,5 @@ console.log(el.textContent); // Output: "console.log(10);"

## See also

- {{domxref("HTMLScriptElement.textContent")}}
- {{domxref("HTMLScriptElement.innerText")}}
- {{domxref("Node.textContent")}}
- {{domxref("HTMLElement.innerText")}}
2 changes: 1 addition & 1 deletion files/en-us/web/api/viewport_segments_api/using/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ This article explains how to use the [Viewport Segments API](/en-US/docs/Web/API

Foldable devices include smartphones, tablets, and laptops. Some fold inward, with the display folding into the interior of the device, and some fold outward, with the display wrapping around the device. Foldable devices come in a variety of forms: some have an actual folding screen, whereas some have separate screens with a physical hinge in the middle. They may be used in landscape orientation, with two screens side-by-side, and portrait orientation, with a top and a bottom screen.

Whatever the case, foldable device displays are intended to act as different segments of the same display surface. While one person's foldable device may appear seemless and be used fully flat, similar to a single-segmented viewport, another may have an apparent seam be used at an angle that is less than a fully open, flat screen. This presents some unique challenges. You can optimize your layout for the display as a single entity, but how can you ensure that design elements fit snugly on the different segments and are not cut into two pieces? And how can you prevent content from being hidden by the physical fold/join?
Whatever the case, foldable device displays are intended to act as different segments of the same display surface. While one person's foldable device may appear seamless and be used fully flat, similar to a single-segmented viewport, another may have an apparent seam be used at an angle that is less than a fully open, flat screen. This presents some unique challenges. You can optimize your layout for the display as a single entity, but how can you ensure that design elements fit snugly on the different segments and are not cut into two pieces? And how can you prevent content from being hidden by the physical fold/join?

The viewport segments API provides features that allow you to detect (in CSS and JavaScript) whether the user's device screen has a fold or join, what size the different segments are, whether they are the same size, and what orientation they are in (side-by-side or top-to-bottom). We'll introduce you to these features in the following sections, then walk through a complete example to show them in action.

Expand Down
7 changes: 3 additions & 4 deletions files/en-us/web/css/filter-function/invert/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -145,12 +145,11 @@ We include CSS that will invert elements based on their `filter` or `svgFilter`
<svg id="svg" height="220" width="220" overflow="visible">
<filter id="svgInvert">
<feComponentTransfer>
<feFuncR type="table" tableValues="0.3 0"/>
<feFuncG type="table" tableValues="0.3 0"/>
<feFuncB type="table" tableValues="0.3 0"/>
<feFuncR type="table" tableValues="0.3 0" />
<feFuncG type="table" tableValues="0.3 0" />
<feFuncB type="table" tableValues="0.3 0" />
</feComponentTransfer>
</filter>
</filter>
<image
href="https://mdn.github.io/shared-assets/images/examples/progress-pride-flag.jpg"
xlink:href="https://mdn.github.io/shared-assets/images/examples/progress-pride-flag.jpg"
Expand Down
117 changes: 55 additions & 62 deletions files/en-us/web/css/scroll-target-group/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -76,12 +76,10 @@ Our markup has a series of {{htmlelement("section")}} elements containing conten
<section id="intro" class="chapter">
<h1>Prose of the century</h1>
<p>
I'm baby xOXO bespoke cupidatat PBR&B, affogato cronut 3 wolf moon ea
narwhal asymmetrical. Af health goth shaman in slow-carb godard echo park.
Tofu farm-to-table labore salvia tote bag food truck dolore gluten-free
poutine kombucha fanny pack +1 franzen lyft fugiat. Chicharrones next level
jianbing, enamel pin seitan cardigan bruh snackwave beard incididunt dolor
lumbersexual before they sold out dreamcatcher single-origin coffee.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla luctus
aliquam dolor, eu lacinia lorem placerat vulputate. Duis felis orci,
pulvinar id metus ut, rutrum luctus orci. Cras porttitor imperdiet nunc, at
ultricies tellus laoreet sit amet.
</p>
</section>
<section id="ch1" class="chapter">
Expand Down Expand Up @@ -111,92 +109,87 @@ Our markup has a series of {{htmlelement("section")}} elements containing conten
<section id="intro" class="chapter">
<h1>My story</h1>
<p>
I'm baby xOXO bespoke cupidatat PBR&B, affogato cronut 3 wolf moon ea
narwhal asymmetrical. Af health goth shaman in slow-carb godard echo park.
Tofu farm-to-table labore salvia tote bag food truck dolore gluten-free
poutine kombucha fanny pack +1 franzen lyft fugiat. Chicharrones next level
jianbing, enamel pin seitan cardigan bruh snackwave beard incididunt dolor
lumbersexual before they sold out dreamcatcher single-origin coffee.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla luctus
aliquam dolor, eu lacinia lorem placerat vulputate. Duis felis orci,
pulvinar id metus ut, rutrum luctus orci. Cras porttitor imperdiet nunc, at
ultricies tellus laoreet sit amet.
</p>
</section>
<section id="ch1" class="chapter">
<h2>Chapter 1</h2>
<p>
I'm baby xOXO bespoke cupidatat PBR&B, affogato cronut 3 wolf moon ea
narwhal asymmetrical. Af health goth shaman in slow-carb godard echo park.
Tofu farm-to-table labore salvia tote bag food truck dolore gluten-free
poutine kombucha fanny pack +1 franzen lyft fugiat. Chicharrones next level
jianbing, enamel pin seitan cardigan bruh snackwave beard incididunt dolor
lumbersexual before they sold out dreamcatcher single-origin coffee.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla luctus
aliquam dolor, eu lacinia lorem placerat vulputate. Duis felis orci,
pulvinar id metus ut, rutrum luctus orci. Cras porttitor imperdiet nunc, at
ultricies tellus laoreet sit amet.
</p>
<p>
Kombucha laborum tempor iceland pour-over. Keytar in echo park gorpcore
bespoke. Art party quinoa stumptown celiac, sed chillwave 3 wolf moon.
Scenester fugiat pariatur, seitan selvage excepteur chambray yuccie artisan.
Sunt schlitz ugh, et jawn sus four loko pop-up post-ironic photo booth
occaecat deep v 8-bit tacos marfa. Tattooed ipsum tbh occaecat umami four
loko adaptogen taiyaki truffaut hexagon neutral milk hotel.
Sed auctor cursus massa at porta. Integer ligula ipsum, tristique sit amet
orci vel, viverra egestas ligula. Curabitur vehicula tellus neque, ac ornare
ex malesuada et. In vitae convallis lacus. Aliquam erat volutpat.
Suspendisse ac imperdiet turpis. Aenean finibus sollicitudin eros pharetra
congue. Duis ornare egestas augue ut luctus. Proin blandit quam nec lacus
varius commodo et a urna. Ut id ornare felis, eget fermentum sapien.
</p>
<p>
Austin mukbang scenester pabst, kale chips helvetica in selvage tote bag
drinking vinegar craft beer pickled meh subway tile +1. Big mood kogi blog,
vape hella seitan veniam.
Nam vulputate diam nec tempor bibendum. Donec luctus augue eget malesuada
ultrices. Phasellus turpis est, posuere sit amet dapibus ut, facilisis sed
est. Nam id risus quis ante semper consectetur eget aliquam lorem. Vivamus
tristique elit dolor, sed pretium metus suscipit vel. Mauris ultricies
lectus sed lobortis finibus. Vivamus eu urna eget velit cursus viverra quis
vestibulum sem. Aliquam tincidunt eget purus in interdum. Cum sociis natoque
penatibus et magnis dis parturient montes, nascetur ridiculus mus.
</p>
</section>
<section id="ch2" class="chapter">
<h2>Chapter 2</h2>
<p>
Kombucha laborum tempor iceland pour-over. Keytar in echo park gorpcore
bespoke. Art party quinoa stumptown celiac, sed chillwave 3 wolf moon.
Scenester fugiat pariatur, seitan selvage excepteur chambray yuccie artisan.
Sunt schlitz ugh, et jawn sus four loko pop-up post-ironic photo booth
occaecat deep v 8-bit tacos marfa. Tattooed ipsum tbh occaecat umami four
loko adaptogen taiyaki truffaut hexagon neutral milk hotel.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla luctus
aliquam dolor, eu lacinia lorem placerat vulputate. Duis felis orci,
pulvinar id metus ut, rutrum luctus orci. Cras porttitor imperdiet nunc, at
ultricies tellus laoreet sit amet.
</p>
<p>
Chillwave gastropub chartreuse deserunt butcher umami meditation ennui. Sus
post-ironic affogato irony non succulents la croix labore tousled. Tumblr
selvage sartorial taxidermy yes plz fashion axe deserunt. Big mood
humblebrag hammock meditation, four dollar toast vice bruh minim tacos
chartreuse drinking vinegar sunt yes plz YOLO cred. Synth chartreuse est,
wayfarers pop-up ut gorpcore consequat ullamco meh lyft crucifix selvage
occaecat.
Sed auctor cursus massa at porta. Integer ligula ipsum, tristique sit amet
orci vel, viverra egestas ligula. Curabitur vehicula tellus neque, ac ornare
ex malesuada et. In vitae convallis lacus. Aliquam erat volutpat.
Suspendisse ac imperdiet turpis. Aenean finibus sollicitudin eros pharetra
congue. Duis ornare egestas augue ut luctus. Proin blandit quam nec lacus
varius commodo et a urna. Ut id ornare felis, eget fermentum sapien.
</p>
</section>
<section id="ch3" class="chapter">
<h2>Chapter 3</h2>
<p>
Chillwave gastropub chartreuse deserunt butcher umami meditation ennui. Sus
post-ironic affogato irony non succulents la croix labore tousled. Tumblr
selvage sartorial taxidermy yes plz fashion axe deserunt. Big mood
humblebrag hammock meditation, four dollar toast vice bruh minim tacos
chartreuse drinking vinegar sunt yes plz YOLO cred. Synth chartreuse est,
wayfarers pop-up ut gorpcore consequat ullamco meh lyft crucifix selvage
occaecat.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla luctus
aliquam dolor, eu lacinia lorem placerat vulputate. Duis felis orci,
pulvinar id metus ut, rutrum luctus orci. Cras porttitor imperdiet nunc, at
ultricies tellus laoreet sit amet.
</p>
<p>
I'm baby xOXO bespoke cupidatat PBR&B, affogato cronut 3 wolf moon ea
narwhal asymmetrical. Af health goth shaman in slow-carb godard echo park.
Tofu farm-to-table labore salvia tote bag food truck dolore gluten-free
poutine kombucha fanny pack +1 franzen lyft fugiat. Chicharrones next level
jianbing, enamel pin seitan cardigan bruh snackwave beard incididunt dolor
lumbersexual before they sold out dreamcatcher single-origin coffee.
Sed auctor cursus massa at porta. Integer ligula ipsum, tristique sit amet
orci vel, viverra egestas ligula. Curabitur vehicula tellus neque, ac ornare
ex malesuada et. In vitae convallis lacus. Aliquam erat volutpat.
Suspendisse ac imperdiet turpis. Aenean finibus sollicitudin eros pharetra
congue. Duis ornare egestas augue ut luctus. Proin blandit quam nec lacus
varius commodo et a urna. Ut id ornare felis, eget fermentum sapien.
</p>
</section>
<section id="ch4" class="chapter">
<h2>Chapter 4</h2>
<p>
Austin mukbang scenester pabst, kale chips helvetica in selvage tote bag
drinking vinegar craft beer pickled meh subway tile +1. Big mood kogi blog,
vape hella seitan veniam.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla luctus
aliquam dolor, eu lacinia lorem placerat vulputate. Duis felis orci,
pulvinar id metus ut, rutrum luctus orci. Cras porttitor imperdiet nunc, at
ultricies tellus laoreet sit amet.
</p>
<p>
I'm baby xOXO bespoke cupidatat PBR&B, affogato cronut 3 wolf moon ea
narwhal asymmetrical. Af health goth shaman in slow-carb godard echo park.
Tofu farm-to-table labore salvia tote bag food truck dolore gluten-free
poutine kombucha fanny pack +1 franzen lyft fugiat. Chicharrones next level
jianbing, enamel pin seitan cardigan bruh snackwave beard incididunt dolor
lumbersexual before they sold out dreamcatcher single-origin coffee.
Sed auctor cursus massa at porta. Integer ligula ipsum, tristique sit amet
orci vel, viverra egestas ligula. Curabitur vehicula tellus neque, ac ornare
ex malesuada et. In vitae convallis lacus. Aliquam erat volutpat.
Suspendisse ac imperdiet turpis. Aenean finibus sollicitudin eros pharetra
congue. Duis ornare egestas augue ut luctus. Proin blandit quam nec lacus
varius commodo et a urna. Ut id ornare felis, eget fermentum sapien.
</p>
</section>
```
Expand Down
4 changes: 2 additions & 2 deletions files/en-us/web/security/attacks/phishing/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,14 +24,14 @@ Phishing attacks are not dependent on naive or inexperienced users: decades of e

## Defenses

One thing that makes phishing challenging for a website to defend against is that the target site is not involved at all in the attack. It's entirely dependent on the user being tricked by the attacker. In this section we will discuss some practices that can help, but the only one that is really effective is using [passkeys](web_authentication_passkeys) instead of passwords.
One thing that makes phishing challenging for a website to defend against is that the target site is not involved at all in the attack. It's entirely dependent on the user being tricked by the attacker. In this section we will discuss some practices that can help, but the only one that is really effective is using [passkeys](#web_authentication_passkeys) instead of passwords.

### DNS configuration

Phishing emails often forge the sender address, to make the victim think that the email really came from the target website. Three {{glossary("DNS")}} records help email servers detect these forgeries, which helps ensure that phishing emails are marked as spam in the victim's email client, or are blocked entirely.

- The [Security Policy Framework (SPF)](https://www.cloudflare.com/en-ca/learning/dns/dns-records/dns-spf-record/) record lists addresses that are allowed to send an email from the domain. A receiving email server extracts the domain name from the email's `Return-Path` header, and looks up the SPF record associated with that domain.
- The [DomainKeys Identified Mail (DKIM)](https://www.cloudflare.com/en-ca/learning/dns/dns-records/dns-dkim-record/) record enables the sender to {{glossary("digital signature", "digitally sign")}} emails. The receiving server extracts the domain name from the signature, and uses it to look up looks up the DKIM record associated with that domain. The DKIM record incldues the public key used to verify the signature. The domain name in the signature must also be aligned with the domain name in the email's `From` header (this essentially means that the domain names must match or the value in ther `From` header must be a subdomain of the domain in the signature).
- The [DomainKeys Identified Mail (DKIM)](https://www.cloudflare.com/en-ca/learning/dns/dns-records/dns-dkim-record/) record enables the sender to {{glossary("digital signature", "digitally sign")}} emails. The receiving server extracts the domain name from the signature, and uses it to look up looks up the DKIM record associated with that domain. The DKIM record includes the public key used to verify the signature. The domain name in the signature must also be aligned with the domain name in the email's `From` header (this essentially means that the domain names must match or the value in the `From` header must be a subdomain of the domain in the signature).
- The [Domain-based Message Authentication Reporting and Conformance (DMARC)](https://www.cloudflare.com/en-ca/learning/dns/dns-records/dns-dmarc-record/) tells the recipient how to handle SPF and DKIM failures: whether to quarantine them as spam, reject them, or allow them.

You should set these DNS records for your domains, to help email servers recognize forged messages.
Expand Down