2003895 - Ship the Sanitizer API

Status: RESOLVED FIXED

(Core :: DOM: Security, task)

Comment 1

[Tom Schuster]

Attachment: Bug 2003895 - Ship the Sanitizer API. r?freddyb!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/bc3b5be30a7a
https://hg.mozilla.org/integration/autoland/rev/e555fef9c4c5
Ship the Sanitizer API. r=freddyb,webidl,saschanaz

Comment 3

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/e555fef9c4c5

Comment 4

[Donal Meehan [:dmeehan]]

Tom, could you consider nominating this for a release note? (Process info)

Comment 5

[Tom Schuster]

Release Note Request (optional, but appreciated)
[Why is this notable]: New API
[Affects Firefox for Android]: zes
[Suggested wording]: Firefox now supports the Element.setHTML() and Document.parseHTML() functions, to safely set or parse HTML with a built-in sanitizer, which can help prevent Cross-Site Scripting vulnerabilities. We also support the Sanitizer() constructor to configure the HTML sanitization.
[Links (documentation, blog post, etc)]: https://developer.mozilla.org/en-US/docs/Web/API/Sanitizer

Comment 6

[Donal Meehan [:dmeehan]]

Thanks, added to the Fx148 nightly release notes, please allow 30 minutes for the site to update.
Keeping the relnote-firefox flag as ? to keep it on the radar for inclusion in the final Fx148 release notes.

Comment 7

[Donal Meehan [:dmeehan]]

Added to the final Fx148 release notes

Comment 8

[Rob Wu [:robwu]]

Fx 148 shipped but dev-doc-needed is still on this bug. Notably, Document.parseHTML is still listed as Nightly-only, despite it being available by default in 148.

Is it just this BCD entry or is there more that is left to update? When completed please change dev-doc-needed to dev-doc-complete.

Comment 9

[Hamish Willee]

FF148 MDN docs work for this can be tracked in https://github.com/mdn/content/issues/42755

FYI, most of the compatibility data and release note done by others. All I've done is added more information on the default configuration (courtesy TomS) and fixed up the ambiguity in the docs that this was limited to only removing XSS-unsafe stuff.
I've marked as dev-doc-complete, but that doc is still going through review.