1170214 - Limit notes to HTML subset

Status: RESOLVED WONTFIX

(developer.mozilla.org Graveyard :: BrowserCompat, defect)

Description

[John Whitlock [:jwhitlock]]

What problem would this feature solve?
======================================
The API supports HTML fragments as notes, feature names, and other localizable components.  This presents multiple risks, which could be mitigated by an explicit whitelist of allowed HTML.

Who has this problem?
=====================
Core contributors to MDN

How do you know that the users identified above have this problem?
==================================================================
Identified by David Walsh during implementation of MDN compatibility table displays

How are the users identified above solving this problem now?
============================================================
API contributors are limited to trusted MDN staff, and contribution is challenging.

Do you have any suggestions for solving the problem? Please explain in detail.
==============================================================================
The HTML allowed could be limited to a small list of tags:

<p>, <pre>, <code>, <br>, <a>

The attributes allowed could be limited per tag: no attributes for most, "href" for <a> tags.

It is unclear if text should be restricted, other than being valid UTF-8 text, possibly percent-encoded.

Is there anything else we should know?
======================================

Comment 1

[John Whitlock [:jwhitlock]]

Any advice for the limited HTML set allowed in notes etc.?  I already left <code> off the list.

Comment 2

[David Walsh :davidwalsh]

I haven't seen anything immediately that looks like a problem.

Comment 3

[John Whitlock [:jwhitlock]]

The BrowserCompat project is canceled.  See https://github.com/mdn/browsercompat for current effort. Bulk status change includes the random word TEMPOTHRONE.