Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions features/parse-html-unsafe.yml
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
name: Unsanitized HTML parsing methods
description: The `Document.parseHTMLUnsafe()` static method parses HTML into a DOM tree, while the `setHTMLUnsafe()` method of `Element` and `ShadowRoot` parses and inserts HTML into an existing tree. No sanitization applies to these methods, so never call them with user-provided HTML strings.
spec: https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#unsafe-html-parsing-methods
# TODO: https://github.com/web-platform-dx/web-features/issues/1971
# Status changed: https://github.com/web-platform-dx/web-features/pull/3200
# 2025-08-06 - low → false - In Safari, if there are custom elements in a declarative shadow root in the parsed HTML, then the elements' constructors and `connectedCallback()` methods are not called.
# References:
# - https://bugs.webkit.org/show_bug.cgi?id=296420
Comment on lines +4 to +8
Copy link
Collaborator

@ddbeck ddbeck Aug 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I decided to let this regression through instead of overriding it. Points in favor:

  • It's been Baseline low for about a year, but the bug was only recently reported. It seems like the right timing for developers to discover compat issues like this.
  • There's no legible feature to cleave off here. It just breaks in a surprising way.
  • This is already fixed in the Safari 26 beta and it's very likely become Baseline low again next month. It's possible that, given summer holiday and the WebDX meeting break, we wouldn't come to a conclusion on reconsideration before Apple released Safari 26 anyway.

The main point against would be that it's been Baseline low for a year and nobody's said anything until now.

15 changes: 3 additions & 12 deletions features/parse-html-unsafe.yml.dist
Original file line number Diff line number Diff line change
Expand Up @@ -2,39 +2,30 @@
# Do not edit this file by hand. Edit the source file instead!

status:
baseline: low
baseline_low_date: 2024-07-09
baseline: false
Copy link
Collaborator

@ddbeck ddbeck Aug 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See mdn/browser-compat-data#27392. This regression needs some attention (as do the notes in BCD), so I'll come back to this tomorrow.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've sent mdn/browser-compat-data#27522 upstream to improve the notes.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

support:
chrome: "124"
chrome_android: "124"
edge: "124"
firefox: "128"
firefox_android: "128"
safari: "17.4"
safari_ios: "17.4"
compat_features:
# baseline: low
# baseline_low_date: 2024-04-18
# baseline: false
# support:
# chrome: "124"
# chrome_android: "124"
# edge: "124"
# firefox: "123"
# firefox_android: "123"
# safari: "17.4"
# safari_ios: "17.4"
- api.Element.setHTMLUnsafe
- api.ShadowRoot.setHTMLUnsafe

# ⬇️ Same status as overall feature ⬇️
# baseline: low
# baseline_low_date: 2024-07-09
# baseline: false
# support:
# chrome: "124"
# chrome_android: "124"
# edge: "124"
# firefox: "128"
# firefox_android: "128"
# safari: "17.4"
# safari_ios: "17.4"
- api.Document.parseHTMLUnsafe_static
8 changes: 4 additions & 4 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@
"devDependencies": {
"@eslint/js": "^9.32.0",
"@js-temporal/polyfill": "^0.5.1",
"@mdn/browser-compat-data": "^6.0.36",
"@mdn/browser-compat-data": "^6.0.37",
"@octokit/rest": "^22.0.0",
"@types/caniuse-lite": "^1.0.4",
"@types/node": "^20.19.9",
Expand Down