HTML

The document open steps, given a document, are as follows:

1. If document is an XML document, then throw an "InvalidStateError" DOMException.

2. If document's throw-on-dynamic-markup-insertion counter is greater than 0, then throw an "InvalidStateError" DOMException.

3. Let entryDocument be the entry global object's associated Document.

4. If document's origin is not same origin to entryDocument's origin, then throw a "SecurityError" DOMException.

5. If document has an active parser whose script nesting level is greater than 0, then return document.

   This basically causes document.open() to be ignored when it's called in an inline script found during parsing, while still letting it have an effect when called from a non-parser task such as a timer callback or event handler.

6. Similarly, if document's unload counter is greater than 0, then return document.

   This basically causes document.open() to be ignored when it's called from a beforeunload, pagehide, or unload event handler while the Document is being unloaded.

7. If document's active parser was aborted is true, then return document.

   This notably causes document.open() to be ignored if it is called after a navigation has started, but only during the initial parse. See issue #4723 for more background.

8. If document's node navigable is non-null and document's node navigable's ongoing navigation is a navigation ID, then stop loading document's node navigable.

9. For each shadow-including inclusive descendant node of document, erase all event listeners and handlers given node.

10. If document is the associated Document of document's relevant global object, then erase all event listeners and handlers given document's relevant global object.

11. Replace all with null within document.

12. If document is fully active, then:

    1. Let newURL be a copy of entryDocument's URL.

    2. If entryDocument is not document, then set newURL's fragment to null.

    3. Run the URL and history update steps with document and newURL.

13. Set document's is initial about:blank to false.

14. If document's iframe load in progress flag is set, then set document's mute iframe load flag.

15. Set document to no-quirks mode.

16. Create a new HTML parser and associate it with document. This is a script-created parser (meaning that it can be closed by the document.open() and document.close() methods, and that the tokenizer will wait for an explicit call to document.close() before emitting an end-of-file token). The encoding confidence is irrelevant.

17. Set the insertion point to point at just before the end of the input stream (which at this point will be empty).

18. Update the current document readiness of document to "loading".

    This causes a readystatechange event to fire, but the event is actually unobservable to author code, because of the previous step which erased all event listeners and handlers that could observe it.

19. Return document.

The open(unused1, unused2) method must return the result of running the document open steps with this.

The unused1 and unused2 arguments are ignored, but kept in the IDL to allow code that calls the function with one or two arguments to continue working. They are necessary due to Web IDL overload resolution algorithm rules, which would throw a TypeError exception for such calls had the arguments not been there. whatwg/webidl issue #581 investigates changing the algorithm to allow for their removal. [WEBIDL]

The open(url, name, features) method must run these steps:

1. If this is not fully active, then throw an "InvalidAccessError" DOMException.

2. Return the result of running the window open steps with url, name, and features.

The close() method must run the following steps:

1. If this is an XML document, then throw an "InvalidStateError" DOMException.

2. If this's throw-on-dynamic-markup-insertion counter is greater than zero, then throw an "InvalidStateError" DOMException.

3. If there is no script-created parser associated with this, then return.

4. Insert an explicit "EOF" character at the end of the parser's input stream.

5. If this's pending parsing-blocking script is not null, then return.

6. Run the tokenizer, processing resulting tokens as they are emitted, and stopping when the tokenizer reaches the explicit "EOF" character or spins the event loop.

The document write steps, given a Document object document, a list text, a boolean lineFeed, and a string sink, are as follows:

1. Let string be the empty string.

2. Let isTrusted be false if text contains a string; otherwise true.

3. For each value of text:

   1. If value is a TrustedHTML object, then append value's associated data to string.

   2. Otherwise, append value to string.

4. If isTrusted is false, set string to the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, string, sink, and "script".

5. If lineFeed is true, append U+000A LINE FEED to string.

6. If document is an XML document, then throw an "InvalidStateError" DOMException.

7. If document's throw-on-dynamic-markup-insertion counter is greater than 0, then throw an "InvalidStateError" DOMException.

8. If document's active parser was aborted is true, then return.

9. If the insertion point is undefined, then:

   1. If document's unload counter is greater than 0 or document's ignore-destructive-writes counter is greater than 0, then return.

   2. Run the document open steps with document.

10. Insert string into the input stream just before the insertion point.

11. If document's pending parsing-blocking script is null, then have the HTML parser process string, one code point at a time, processing resulting tokens as they are emitted, and stopping when the tokenizer reaches the insertion point or when the processing of the tokenizer is aborted by the tree construction stage (this can happen if a script end tag token is emitted by the tokenizer).

    If the document.write() method was called from script executing inline (i.e. executing because the parser parsed a set of script tags), then this is a reentrant invocation of the parser. If the parser pause flag is set, the tokenizer will abort immediately and no HTML will be parsed, per the tokenizer's parser pause flag check.

The document.write(...text) method steps are to run the document write steps with this, text, false, and "Document write".

The document.writeln(...text) method steps are to run the document write steps with this, text, true, and "Document writeln".

partial interface Element {
  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
  DOMString getHTML(optional GetHTMLOptions options = {});

  [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
  [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) outerHTML;
  [CEReactions] undefined insertAdjacentHTML(DOMString position, (TrustedHTML or DOMString) string);
};

partial interface ShadowRoot {
  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
  DOMString getHTML(optional GetHTMLOptions options = {});

  [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
};

enum SanitizerPresets { "default" };
dictionary SetHTMLOptions {
  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = "default";
};
dictionary SetHTMLUnsafeOptions {
  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
};

dictionary GetHTMLOptions {
  boolean serializableShadowRoots = false;
  sequence<ShadowRoot> shadowRoots = [];
};

[Exposed=Window]
interface DOMParser {
  constructor();

  [NewObject] Document parseFromString((TrustedHTML or DOMString) string, DOMParserSupportedType type);
};

enum DOMParserSupportedType {
  "text/html",
  "text/xml",
  "application/xml",
  "application/xhtml+xml",
  "image/svg+xml"
};

The new DOMParser() constructor steps are to do nothing.

The parseFromString(string, type) method steps are:

1. Let compliantString be the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, string, "DOMParser parseFromString", and "script".

2. Let document be a new Document, whose content type is type and URL is this's relevant global object's associated Document's URL.

   The document's encoding will be left as its default, of UTF-8. In particular, any XML declarations or meta elements found while parsing compliantString will have no effect.

3. Switch on type:

   "text/html"

   1. Parse HTML from a string given document and compliantString.

   Since document does not have a browsing context, scripting is disabled.

   Otherwise

   1. Create an XML parser parser, associated with document, and with XML scripting support disabled.

   2. Parse compliantString using parser.

   3. If the previous step resulted in an XML well-formedness or XML namespace well-formedness error, then:

      1. Assert: document has no child nodes.

      2. Let root be the result of creating an element given document, "parsererror", and "http://www.mozilla.org/newlayout/xml/parsererror.xml".

      3. Optionally, add attributes or children to root to describe the nature of the parsing error.

      4. Append root to document.

4. Return document.

To parse HTML from a string, given a Document document and a string html:

1. Set document's type to "html".

2. Create an HTML parser parser, associated with document.

3. Place html into the input stream for parser. The encoding confidence is irrelevant.

4. Start parser and let it run until it has consumed all the characters just inserted into the input stream.

   This might mutate the document's mode.

Element's setHTMLUnsafe(html, options) method steps are:

1. Let compliantHTML be the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, html, "Element setHTMLUnsafe", and "script".

2. Let target be this's template contents if this is a template element; otherwise this.

3. Set and filter HTML given target, this, compliantHTML, options, and false.

ShadowRoot's setHTMLUnsafe(html, options) method steps are:

1. Let compliantHTML be the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, html, "ShadowRoot setHTMLUnsafe", and "script".

2. Set and filter HTML given this, this's shadow host, compliantHTML, options, and false.

Element's setHTML(html, options) method steps are:

1. Let target be this's template contents if this is a template element; otherwise this.

2. Set and filter HTML given target, this, html, options, and true.

ShadowRoot's setHTML(html, options) method steps are:

1. Set and filter HTML given this, this's shadow host, html, options, and true.

The static parseHTMLUnsafe(html, options) method steps are:

1. Let compliantHTML be the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, html, "Document parseHTMLUnsafe", and "script".

2. Let document be a new Document, whose content type is "text/html".

   Since document does not have a browsing context, scripting is disabled.

3. Set document's allow declarative shadow roots to true.

4. Parse HTML from a string given document and compliantHTML.

5. Let sanitizer be the result of calling get a sanitizer instance from options with options and false.

6. Call sanitize on document with sanitizer and false.

7. Return document.

The static parseHTML(html, options) method steps are:

1. Let document be a new Document, whose content type is "text/html".

   Since document does not have a browsing context, scripting is disabled.

2. Set document's allow declarative shadow roots to true.

3. Parse HTML from a string given document and html.

4. Let sanitizer be the result of calling get a sanitizer instance from options with options and true.

5. Call sanitize on document with sanitizer and true.

6. Return document.

Element's getHTML(options) method steps are to return the result of HTML fragment serialization algorithm with this, options["serializableShadowRoots"], and options["shadowRoots"].

ShadowRoot's getHTML(options) method steps are to return the result of HTML fragment serialization algorithm with this, options["serializableShadowRoots"], and options["shadowRoots"].

The fragment serializing algorithm steps, given an Element, Document, or DocumentFragment node and a boolean require well-formed, are:

1. Let context document be node's node document.

2. If context document is an HTML document, return the result of HTML fragment serialization algorithm with node, false, and « ».

3. Return the XML serialization of node given require well-formed.

The fragment parsing algorithm steps, given an Element context, a string markup, and an optional parser scripting mode scriptingMode (default Inert), are:

1. Assert: scriptingMode is either Inert or Fragment.

2. Let newChildren be null.

3. If context's node document is an XML document, then set newChildren to the result of invoking the XML fragment parsing algorithm given context and markup.

4. Otherwise, set newChildren to the result of invoking the HTML fragment parsing algorithm given context, markup, false, and scriptingMode.

5. Let fragment be a new DocumentFragment whose node document is context's node document.

6. For each node of newChildren, in tree order: append node to fragment.

   This ensures the node document for the new nodes is correct.

7. Return fragment.

Element's innerHTML getter steps are to return the result of running fragment serializing algorithm steps with this and true.

ShadowRoot's innerHTML getter steps are to return the result of running fragment serializing algorithm steps with this and true.

Element's innerHTML setter steps are:

1. Let compliantString be the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, the given value, "Element innerHTML", and "script".

2. Let context be this.

3. Let fragment be the result of invoking the fragment parsing algorithm steps with context and compliantString.

4. If context is a template element, then set context to the template element's template contents (a DocumentFragment).

   Setting innerHTML on a template element will replace all the nodes in its template contents rather than its children.

5. Replace all with fragment within context.

ShadowRoot's innerHTML setter steps are:

1. Let compliantString be the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, the given value, "ShadowRoot innerHTML", and "script".

2. Let context be this's host.

3. Let fragment be the result of invoking the fragment parsing algorithm steps with context and compliantString.

4. Replace all with fragment within this.

Element's outerHTML getter steps are:

1. Let element be a fictional node whose only child is this.

2. Return the result of running fragment serializing algorithm steps with element and true.

Element's outerHTML setter steps are:

1. Let compliantString be the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, the given value, "Element outerHTML", and "script".

2. Let parent be this's parent.

3. If parent is null, return. There would be no way to obtain a reference to the nodes created even if the remaining steps were run.

4. If parent is a Document, throw a "NoModificationAllowedError" DOMException.

5. If parent is a DocumentFragment, set parent to the result of creating an element given this's node document, "body", and the HTML namespace.

6. Let fragment be the result of invoking the fragment parsing algorithm steps given parent and compliantString.

7. Replace this with fragment within this's parent.

Element's insertAdjacentHTML(position, string) method steps are:

1. Let compliantString be the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, string, "Element insertAdjacentHTML", and "script".

2. Let context be null.

3. Use the first matching item from this list:

   If position is an ASCII case-insensitive match for the string "beforebegin"

   If position is an ASCII case-insensitive match for the string "afterend"

   1. Set context to this's parent.

   2. If context is null or a Document, throw a "NoModificationAllowedError" DOMException.

   If position is an ASCII case-insensitive match for the string "afterbegin"

   If position is an ASCII case-insensitive match for the string "beforeend"

   Set context to this.

   Otherwise

   Throw a "SyntaxError" DOMException.

4. If context is not an Element or all of the following are true:

   • context's node document is an HTML document;

   • context's local name is "html"; and

   • context's namespace is the HTML namespace,

   then set context to the result of creating an element given this's node document, "body", and the HTML namespace.

5. Let fragment be the result of invoking the fragment parsing algorithm steps with context and compliantString.

6. Use the first matching item from this list:

   If position is an ASCII case-insensitive match for the string "beforebegin"

   Insert fragment into this's parent before this.

   If position is an ASCII case-insensitive match for the string "afterbegin"

   Insert fragment into this before its first child.

   If position is an ASCII case-insensitive match for the string "beforeend"

   Append fragment to this.

   If position is an ASCII case-insensitive match for the string "afterend"

   Insert fragment into this's parent before this's next sibling.

partial interface Range {
  [CEReactions, NewObject] DocumentFragment createContextualFragment((TrustedHTML or DOMString) string);
};

Range's createContextualFragment(string) method steps are:

1. Let compliantString be the result of invoking the get trusted type compliant string algorithm with TrustedHTML, this's relevant global object, string, "Range createContextualFragment", and "script".

2. Let node be this's start node.

3. Let element be null.

4. If node implements Element, set element to node.

5. Otherwise, if node implements Text or Comment, set element to node's parent element.

6. If element is null or all of the following are true:

   • element's node document is an HTML document;

   • element's local name is "html"; and

   • element's namespace is the HTML namespace,

   then set element to the result of creating an element given this's node document, "body", and the HTML namespace.

7. Return the result of invoking the fragment parsing algorithm steps with element, compliantString, and Fragment.

[Exposed=Window]
interface XMLSerializer {
  constructor();

  DOMString serializeToString(Node root);
};

The new XMLSerializer() constructor steps are to do nothing.

The serializeToString(root) method steps are:

1. Return the XML serialization of root given false.

[Exposed=Window]
interface Sanitizer {
  constructor(optional (SanitizerConfig or SanitizerPresets) configuration = "default");

  // Query configuration:
  SanitizerConfig get();

  // Modify a Sanitizer's lists and fields:
  boolean allowElement(SanitizerElementWithAttributes element);
  boolean removeElement(SanitizerElement element);
  boolean replaceElementWithChildren(SanitizerElement element);
  boolean allowProcessingInstruction(SanitizerPI pi);
  boolean removeProcessingInstruction(SanitizerPI pi);
  boolean allowAttribute(SanitizerAttribute attribute);
  boolean removeAttribute(SanitizerAttribute attribute);
  boolean setComments(boolean allow);
  boolean setDataAttributes(boolean allow);

  // Remove markup that executes script.
  boolean removeUnsafe();
};

The new Sanitizer(configuration) constructor steps are:

1. If configuration is a SanitizerPresets string, then:

   1. Assert: configuration is "default".

   2. Set configuration to the built-in safe default configuration.

2. Configure this given configuration and true.

To configure a Sanitizer sanitizer, given a dictionary configuration and a boolean allowCommentsPIsAndDataAttributes:

1. Canonicalize the configuration configuration with allowCommentsPIsAndDataAttributes.

2. If configuration is not valid, then throw a TypeError.

3. Set sanitizer's configuration to configuration.

To canonicalize the configuration SanitizerConfig configuration with a boolean allowCommentsPIsAndDataAttributes:

1. For each member of configuration that is a list of strings:

   1. Replace each string in member with the result of canonicalizing it.

2. If neither configuration["elements"] nor configuration["removeElements"] exists, then set configuration["removeElements"] to an empty list.

3. If neither configuration["attributes"] nor configuration["removeAttributes"] exists, then set configuration["removeAttributes"] to an empty list.

4. If neither configuration["processingInstructions"] nor configuration["removeProcessingInstructions"] exists, then:

   1. If allowCommentsPIsAndDataAttributes is true, then set configuration["removeProcessingInstructions"] to an empty list.

   2. Otherwise, set configuration["processingInstructions"] to an empty list.

5. If configuration["elements"] exists, then:

   1. Let newElements be « ».

   2. For each element of configuration["elements"], append the result of canonicalizing element to newElements.

   3. Set configuration["elements"] to newElements.

6. If configuration["removeElements"] exists, then set configuration["removeElements"] to the result of canonicalizing configuration["removeElements"].

7. If configuration["attributes"] exists, then set configuration["attributes"] to the result of canonicalizing configuration["attributes"].

8. If configuration["removeAttributes"] exists, then set configuration["removeAttributes"] to the result of canonicalizing configuration["removeAttributes"].

9. If configuration["replaceWithChildrenElements"] exists, then set configuration["replaceWithChildrenElements"] to the result of canonicalizing configuration["replaceWithChildrenElements"].

10. If configuration["processingInstructions"] exists, then set configuration["processingInstructions"] to the result of canonicalizing configuration["processingInstructions"].

11. If configuration["removeProcessingInstructions"] exists, then set configuration["removeProcessingInstructions"] to the result of canonicalizing configuration["removeProcessingInstructions"].

12. If configuration["comments"] does not exist, then set it to allowCommentsPIsAndDataAttributes.

13. If configuration["attributes"] exists and configuration["dataAttributes"] does not exist, then set it to allowCommentsPIsAndDataAttributes.

To canonicalize a sanitizer list list:

1. Let newList be « ».

2. For each item in list, append the result of canonicalizing item to newList.

3. Return newList.

To canonicalize a processing instruction list list:

1. Let newList be « ».

2. For each item in list, append the result of canonicalizing item to newList.

3. Return newList.

To canonicalize a processing instruction given a SanitizerPI pi:

1. If pi is a DOMString, then return «[ "target" → pi ]».

2. Assert: pi is a dictionary and pi["target"] exists.

3. Return «[ "target" → pi["target"] ]».

To canonicalize a sanitizer name given a DOMString or dictionary name, and a default namespace defaultNamespace (default null):

1. If name is a DOMString, then return «[ "name" → name, "namespace" → defaultNamespace ]».

2. Assert: name is a dictionary and both name["name"] and name["namespace"] exist.

3. If name["namespace"] is the empty string, then set it to null.

4. Return «[ "name" → name["name"], "namespace" → name["namespace"] ]».

To canonicalize a sanitizer element given a SanitizerElement element:

1. Return the result of canonicalizing element with the HTML namespace as the default namespace.

To canonicalize a sanitizer element list list:

1. Let newList be « ».

2. For each item in list, append the result of canonicalizing item to newList.

3. Return newList.

To find the canonicalized intersection of lists A and B:

1. Let setA be « ».

2. Let setB be « ».

3. For each entry of A, append the result of canonicalizing entry to setA.

4. For each entry of B, append the result of canonicalizing entry to setB.

5. Return the intersection of setA and setB.

The get() method steps are:

Outside of the get() method, the order of the Sanitizer's elements and attributes is unobservable. By explicitly sorting the result of this method, we give implementations the opportunity to optimize by, for example, using unordered sets internally.

1. Let config be this's configuration.

2. Assert: config is valid.

3. If config["elements"] exists, then:

   1. For any element of config["elements"]:

      1. If element["attributes"] exists, then set element["attributes"] to the result of sort in ascending order element["attributes"], with compare sanitizer items.

      2. If element["removeAttributes"] exists, then set element["removeAttributes"] to the result of sort in ascending order element["removeAttributes"], with compare sanitizer items.

   2. Set config["elements"] to the result of sort in ascending order config["elements"], with compare sanitizer items.

4. Otherwise:

   1. Set config["removeElements"] to the result of sort in ascending order config["removeElements"], with compare sanitizer items.

5. If config["replaceWithChildrenElements"] exists, then set config["replaceWithChildrenElements"] to the result of sort in ascending order config["replaceWithChildrenElements"], with compare sanitizer items.

6. If config["processingInstructions"] exists, then set config["processingInstructions"] to the result of sort in ascending order config["processingInstructions"], with piA["target"] being code unit less than piB["target"].

7. Otherwise:

   1. Set config["removeProcessingInstructions"] to the result of sorting config["removeProcessingInstructions"], with piA["target"] being code unit less than piB["target"].

8. If config["attributes"] exists, then set config["attributes"] to the result of sorting config["attributes"] given compare sanitizer items.

9. Otherwise:

   1. Set config["removeAttributes"] to the result of sorting config["removeAttributes"] given compare sanitizer items.

10. Return config.

The allowElement(element) method steps are:

1. Let configuration be this's configuration.

2. Assert: configuration is valid.

3. Set element to the result of canonicalizing element.

4. If configuration["elements"] exists, then:

   1. Let modified be the result of removing element from configuration["replaceWithChildrenElements"].

   2. If configuration["attributes"] exists, then:

      1. If element["attributes"] exists, then:

         1. Set element["attributes"] to the result of removing duplicates from element["attributes"].

         2. Set element["attributes"] to the difference of element["attributes"] and configuration["attributes"].

         3. If configuration["dataAttributes"] is true, then remove all items item from element["attributes"] where item is a custom data attribute.

      2. If element["removeAttributes"] exists, then:

         1. Set element["removeAttributes"] to the result of removing duplicates from element["removeAttributes"].

         2. Set element["removeAttributes"] to the intersection of element["removeAttributes"] and configuration["attributes"].

   3. Otherwise:

      1. If element["attributes"] exists, then:

         1. Set element["attributes"] to the result of removing duplicates from element["attributes"].

         2. Set element["attributes"] to the difference of element["attributes"] and element["removeAttributes"] (or an empty list if it does not exist).

         3. Remove element["removeAttributes"].

         4. Set element["attributes"] to the difference of element["attributes"] and configuration["removeAttributes"].

      2. If element["removeAttributes"] exists, then:

         1. Set element["removeAttributes"] to the result of removing duplicates from element["removeAttributes"].

         2. Set element["removeAttributes"] to the difference of element["removeAttributes"] and configuration["removeAttributes"].

   4. If configuration["elements"] does not contain element, then:

      1. Append element to configuration["elements"].

      2. Return true.

   5. Let current element be the item in configuration["elements"] whose name member is element's name member and whose namespace member is element's namespace member.

   6. If element is equal to current element, then return modified.

   7. Remove element from configuration["elements"].

   8. Append element to configuration["elements"].

   9. Return true.

5. Otherwise:

   1. If element["attributes"] exists or element["removeAttributes"] (or an empty list if it does not exist) is not empty, then return false.

   2. Let modified be the result of removing element from configuration["replaceWithChildrenElements"].

   3. If configuration["removeElements"] does not contain element, then return modified.

   4. Remove element from configuration["removeElements"].

   5. Return true.

The removeElement(element) method steps are to return the result of removing element from this's configuration.

The replaceElementWithChildren(element) method steps are:

1. Let configuration be this's configuration.

2. Assert: configuration is valid.

3. Set element to the result of canonicalizing element.

4. If the built-in non-replaceable elements list contains element, then return false.

5. Let modified be the result of removing element from configuration["elements"].

6. If removing element from configuration["removeElements"] is true, then set modified to true.

7. If configuration["replaceWithChildrenElements"] does not contains element, then:

   1. Append element to configuration["replaceWithChildrenElements"].

   2. Return true.

8. Return modified.

The allowAttribute(attribute) method steps are:

1. Let configuration be this's configuration.

2. Assert: configuration is valid.

3. Set attribute to the result of canonicalizing with attribute.

4. If configuration["attributes"] exists, then:

   1. If configuration["dataAttributes"] is true and attribute is a custom data attribute, then return false.

   2. If configuration["attributes"] contains attribute, then return false.

   3. If configuration["elements"] exists, then:

      1. For each element in configuration["elements"]:

         1. If element["attributes"] (or an empty list if it does not exist) contains attribute, then remove attribute from element["attributes"].

   4. Append attribute to configuration["attributes"].

   5. Return true.

5. Otherwise:

   1. If configuration["removeAttributes"] does not contain attribute, then return false.

   2. Remove attribute from configuration["removeAttributes"].

   3. Return true.

The removeAttribute(attribute) method steps are to return the result of remove an attribute with attribute and this's configuration.

The setComments(allow) method steps are:

1. Let configuration be this's configuration.

2. Assert: configuration is valid.

3. If configuration["comments"] exists and is equal to allow, then return false.

4. Set configuration["comments"] to allow.

5. Return true.

The setDataAttributes(allow) method steps are:

1. Let configuration be this's configuration.

2. Assert: configuration is valid.

3. If configuration["attributes"] does not exist, then return false.

4. If configuration["dataAttributes"] exists and is equal to allow, then return false.

5. If allow is true, then:

   1. If configuration["elements"] exists, then:

      1. For each element of configuration["elements"]:

         1. If element["attributes"] exists, then remove all items item from element["attributes"] where item is a custom data attribute.

   2. Remove all items item from configuration["attributes"] where item is a custom data attribute.

6. Set configuration["dataAttributes"] to allow.

7. Return true.

The allowProcessingInstruction(pi) method steps are:

1. Let configuration be this's configuration.

2. Set pi to the result of canonicalizing pi.

3. If configuration["processingInstructions"] exists, then:

   1. If configuration["processingInstructions"] contains pi, then return false.

   2. Append pi to configuration["processingInstructions"].

   3. Return true.

4. Otherwise:

   1. If configuration["removeProcessingInstructions"] contains pi, then:

      1. Remove pi from configuration["removeProcessingInstructions"].

      2. Return true.

   2. Return false.

The removeProcessingInstruction(pi) method steps are:

1. Let configuration be this's configuration.

2. Set pi to the result of canonicalizing pi.

3. If configuration["processingInstructions"] exists, then:

   1. If configuration["processingInstructions"] contains pi, then:

      1. Remove pi from configuration["processingInstructions"].

      2. Return true.

   2. Return false.

4. Otherwise:

   1. If configuration["removeProcessingInstructions"] contains pi, then return false.

   2. Append pi to configuration["removeProcessingInstructions"].

   3. Return true.

The removeUnsafe() method steps are to remove unsafe from this's configuration.

dictionary SanitizerElementNamespace {
  required DOMString name;
  DOMString? _namespace = "http://www.w3.org/1999/xhtml";
};

// Used by "elements"
dictionary SanitizerElementNamespaceWithAttributes : SanitizerElementNamespace {
  sequence<SanitizerAttribute> attributes;
  sequence<SanitizerAttribute> removeAttributes;
};

dictionary SanitizerAttributeNamespace {
  required DOMString name;
  DOMString? _namespace = null;
};

dictionary SanitizerProcessingInstruction {
  required DOMString target;
};

typedef (DOMString or SanitizerElementNamespace) SanitizerElement;
typedef (DOMString or SanitizerElementNamespaceWithAttributes) SanitizerElementWithAttributes;
typedef (DOMString or SanitizerProcessingInstruction) SanitizerPI;
typedef (DOMString or SanitizerAttributeNamespace) SanitizerAttribute;

dictionary SanitizerConfig {
  sequence<SanitizerElementWithAttributes> elements;
  sequence<SanitizerElement> removeElements;
  sequence<SanitizerElement> replaceWithChildrenElements;

  sequence<SanitizerProcessingInstruction> processingInstructions;
  sequence<SanitizerProcessingInstruction> removeProcessingInstructions;

  sequence<SanitizerAttribute> attributes;
  sequence<SanitizerAttribute> removeAttributes;

  boolean comments;
  boolean dataAttributes;
};

To set and filter HTML, given an Element or DocumentFragment target, an Element contextElement, a string html, a dictionary options, and a boolean safe:

1. If all of the following are true:

   • safe is true;

   • contextElement's local name is "script"; and

   • contextElement's namespace is the HTML namespace or the SVG namespace,

   then return.

2. Let sanitizer be the result of calling getting a sanitizer from options given safe.

3. Let newChildren be the result of parsing a fragment given contextElement, html, and true.

4. Let fragment be a new DocumentFragment whose node document is contextElement's node document.

5. For each node in newChildren, append node to fragment.

6. Sanitize fragment given sanitizer and safe.

7. Replace all with fragment within target.

To get a sanitizer instance from options from a dictionary options with a boolean safe:

1. Let sanitizerSpec be "default".

2. If options["sanitizer"] exists, then set sanitizerSpec to options["sanitizer"].

3. Assert: sanitizerSpec is either a Sanitizer instance, a SanitizerPresets member, or a SanitizerConfig dictionary.

4. If sanitizerSpec is a string, then:

   1. Assert: sanitizerSpec is "default".

   2. Set sanitizerSpec to the built-in safe default configuration.

5. If sanitizerSpec is a dictionary, then:

   1. Let sanitizer be a new Sanitizer object.

   2. Let allowCommentsAndDataAttributes be true if safe is false; false otherwise.

   3. Configure sanitizer given sanitizerSpec and allowCommentsAndDataAttributes.

   4. Set sanitizerSpec to sanitizer.

6. Return sanitizerSpec.

To sanitize a Node node with a Sanitizer sanitizer and a boolean safe:

1. Let configuration be sanitizer's configuration.

2. Assert: configuration is valid.

3. If safe is true, then remove unsafe from configuration.

4. Sanitize node given configuration and safe.

To perform the inner sanitize steps on a Node node, given a SanitizerConfig configuration, and a boolean handleJavascriptNavigationUrls:

1. For each child of node's children:

   1. Assert: child is a Text, Comment, Element, ProcessingInstruction, or DocumentType node.

   2. If child is a DocumentType or Text node, then continue.

   3. If child is a Comment node, then:

      1. If configuration["comments"] is false, then remove child.

      2. Continue.

   4. If child is a ProcessingInstruction node, then:

      1. Let piTarget be child's target.

      2. If configuration["processingInstructions"] exists, then:

         1. If configuration["processingInstructions"] does not contain piTarget, then remove child.

      3. Otherwise:

         1. If configuration["removeProcessingInstructions"] contains piTarget, then remove child.

   5. Otherwise:

      1. Let elementName be a SanitizerElementNamespace with child's local name and namespace.

      2. If configuration["replaceWithChildrenElements"] exists and configuration["replaceWithChildrenElements"] contains elementName, then:

         1. Assert: node is not a Document.

         2. Sanitize child given configuration and handleJavascriptNavigationUrls.

         3. Let fragment be a new DocumentFragment whose node document is node's node document.

         4. For each innerChild of child's children, append innerChild to fragment.

         5. Replace child with fragment within node. Assert that this did not throw.

         6. Continue.

      3. If configuration["elements"] exists, then:

         1. If configuration["elements"] does not contain elementName, then remove child and continue.

      4. Otherwise:

         1. If configuration["removeElements"] contains elementName, then remove child and continue.

      5. If elementName is a template element in the HTML namespace, then sanitize child's template contents given configuration and handleJavascriptNavigationUrls.

      6. If child is a shadow host, then sanitize child's shadow root given configuration and handleJavascriptNavigationUrls.

      7. Let elementWithLocalAttributes be « ».

      8. If configuration["elements"] exists and configuration["elements"] contains elementName, then set elementWithLocalAttributes to configuration["elements"][elementName].

      9. For each attribute in child's attribute list:

         1. Let attrName be a SanitizerAttributeNamespace with attribute's local name and namespace.

         2. If elementWithLocalAttributes["removeAttributes"] exists and elementWithLocalAttributes["removeAttributes"] contains attrName, then remove attribute from child's attribute list.

         3. Otherwise, if configuration["attributes"] exists, then:

            1. If configuration["attributes"] does not contain attrName and elementWithLocalAttributes["attributes"] does not contain attrName, and if "data-" is not a prefix of attribute's local name or attribute's namespace is not null or configuration["dataAttributes"] is false, then remove attribute from child's attribute list.

         4. Otherwise:

            1. If elementWithLocalAttributes["attributes"] exists and elementWithLocalAttributes["attributes"] does not contain attrName, then remove attribute from child's attribute list.

            2. Otherwise, if configuration["removeAttributes"] contains attrName, then remove attribute from child's attribute list.

         5. If handleJavascriptNavigationUrls is true, then:

            1. If the pair (elementName, attrName) matches an entry in the built-in navigating URL attributes list, and if attribute contains a javascript: URL, then remove attribute from child's attribute list.

            2. If child's namespace is the MathML Namespace, attribute's local name is "href", and attribute's namespace is null or the XLink namespace, and attribute contains a javascript: URL, then remove attribute from child's attribute list.

            3. If the built-in animating URL attributes list contains the pair (elementName, attrName), and attribute's value is "href" or "xlink:href", then remove attribute from child's attribute list.

      10. Sanitize child given configuration and handleJavascriptNavigationUrls.

To determine whether an attribute attribute contains a javascript: URL:

1. Let url be the result of running the basic URL parser on attribute's value.

2. If url is failure, then return false.

3. Return true if url's scheme is "javascript", and false otherwise.

To remove an element element from a SanitizerConfig configuration:

1. Assert: configuration is valid.

2. Set element to the result of canonicalizing element.

3. Let modified be the result of removing element from configuration["replaceWithChildrenElements"].

4. If configuration["elements"] exists, then:

   1. If configuration["elements"] contains element, then:

      1. Remove element from configuration["elements"].

      2. Return true.

   2. Return modified.

5. Otherwise:

   1. If configuration["removeElements"] contains element, then return modified.

   2. Add element to configuration["removeElements"].

   3. Return true.

To remove an attribute attribute from a SanitizerConfig configuration:

1. Assert: configuration is valid.

2. Set attribute to the result of canonicalizing with attribute.

3. If configuration["attributes"] exists, then:

   1. Let modified be the result of removing attribute from configuration["attributes"].

   2. If configuration["elements"] exists, then:

      1. For each element of configuration["elements"]:

         1. If element["attributes"] (or an empty list if it does not exist) contains attribute, then:

            1. Set modified to true.

            2. Remove attribute from element["attributes"].

         2. If element["removeAttributes"] (or an empty list if it does not exist) contains attribute, then:

            1. Assert: modified is true.

            2. Remove attribute from element["removeAttributes"].

   3. Return modified.

4. Otherwise:

   1. If configuration["removeAttributes"] contains attribute, then return false.

   2. If configuration["elements"] exists, then:

      1. For each element in configuration["elements"]:

         1. If element["attributes"] (or an empty list if it does not exist) contains attribute, then remove attribute from element["attributes"].

         2. If element["removeAttributes"] (or an empty list if it does not exist) contains attribute, then remove attribute from element["removeAttributes"].

   3. Add attribute to configuration["removeAttributes"].

   4. Return true.

To remove unsafe from a SanitizerConfig configuration:

1. Assert: configuration is valid.

2. Let result be false.

3. For each element in built-in safe baseline configuration["removeElements"]:

   1. If removing element from configuration is true, then set result to true.

4. For each attribute in built-in safe baseline configuration["removeAttributes"]:

   1. If removing attribute from configuration is true, then set result to true.

5. For each attribute that is an event handler content attribute:

   1. If removing attribute from configuration is true, then set result to true.

6. Return result.

To compare sanitizer items itemA and itemB:

1. Let namespaceA be itemA["namespace"].

2. Let namespaceB be itemB["namespace"].

3. If namespaceA is null, then:

   1. If namespaceB is not null, then return true.

4. Otherwise:

   1. If namespaceB is null, then return false.

   2. If namespaceA is code unit less than namespaceB, then return true.

   3. If namespaceA is not namespaceB, then return false.

5. If itemA["name"] is code unit less than itemB["name"], then return true.

6. Return false.

To canonicalize a SanitizerElementWithAttributes element:

1. Let result be the result of canonicalizing element.

2. If element is a dictionary, then:

   1. If element["attributes"] exists, then set result["attributes"] to the result of canonicalizing element["attributes"].

   2. If element["removeAttributes"] exists, then set result["removeAttributes"] to the result of canonicalizing element["removeAttributes"].

3. If neither result["attributes"] nor result["removeAttributes"] exists, then set result["removeAttributes"] to an empty list.

4. Return result.

To determine whether a canonical SanitizerConfig config is valid:

It's expected that the configuration being passing in has previously been run through the canonicalize the configuration steps. We will simply assert conditions that that algorithm is guaranteed to hold.

1. Assert: config["elements"] exists or config["removeElements"] exists.

2. If config["elements"] exists and config["removeElements"] exists, then return false.

3. Assert: Either config["processingInstructions"] exists or config["removeProcessingInstructions"] exists.

4. If config["processingInstructions"] exists and config["removeProcessingInstructions"] exists, then return false.

5. Assert: Either config["attributes"] exists or config["removeAttributes"] exists.

6. If config["attributes"] exists and config["removeAttributes"] exists, then return false.

7. Assert: All SanitizerElementNamespaceWithAttributes, SanitizerElementNamespace, SanitizerProcessingInstruction, and SanitizerAttributeNamespace items in config are canonical, meaning they have been run through canonicalizing, as appropriate.

8. If config["elements"] exists:

   1. If config["elements"] has duplicates, then return false.

9. Otherwise:

   1. If config["removeElements"] has duplicates, then return false.

10. If config["replaceWithChildrenElements"] exists and has duplicates, then return false.

11. If config["processingInstructions"] exists:

    1. If config["processingInstructions"] has duplicate targets, then return false.

12. Otherwise:

    1. If config["removeProcessingInstructions"] has duplicates, then return false.

13. If config["attributes"] exists:

    1. If config["attributes"] has duplicates, then return false.

14. Otherwise:

    1. If config["removeAttributes"] has duplicates, then return false.

15. If config["replaceWithChildrenElements"] exists:

    1. For each element of config["replaceWithChildrenElements"]:

       1. If the built-in non-replaceable elements list contains element, then return false.

    2. If config["elements"] exists:

       1. If the intersection of config["elements"] and config["replaceWithChildrenElements"] is not empty, then return false.

    3. Otherwise:

       1. If the intersection of config["removeElements"] and config["replaceWithChildrenElements"] is not empty, then return false.

16. If config["attributes"] exists:

    1. Assert: config["dataAttributes"] exists.

    2. If config["elements"] exists:

       1. For each element of config["elements"]:

          1. If element["attributes"] exists and element["attributes"] has duplicates, then return false.

          2. If element["removeAttributes"] exists and element["removeAttributes"] has duplicates, then return false.

          3. If the intersection of config["attributes"] and element["attributes"] (or an empty list if it does not exist) is not empty, then return false.

          4. If element["removeAttributes"] (or an empty list if it does not exist) is not a subset of config["attributes"], then return false.

          5. If config["dataAttributes"] is true and element["attributes"] contains a custom data attribute, then return false.

    3. If config["dataAttributes"] is true and config["attributes"] contains a custom data attribute, then return false.

17. Otherwise:

    1. If config["elements"] exists:

       1. For each element of config["elements"]:

          1. If element["attributes"] exists and element["removeAttributes"] exists, then return false.

          2. If element["attributes"] exists and element["attributes"] has duplicates, then return false.

          3. If element["removeAttributes"] exists and element["removeAttributes"] has duplicates, then return false.

          4. If the intersection of config["removeAttributes"] and element["attributes"] (or an empty list if it does not exist) is not empty, then return false.

          5. If the intersection of config["removeAttributes"] and element["removeAttributes"] (or an empty list if it does not exist) is not empty, then return false.

    2. If config["dataAttributes"] exists, then return false.

18. Return true.