Closed Bug 2071032 Opened 2 months ago Closed 2 months ago

[wpt-sync] Sync PR 62564 - Sanitizer: fix the javascript: URL tests and cover the default configuration

Tracking

()

Status:

RESOLVED FIXED

Milestone:

158 Branch

Tracking Flags:

Tracking

Status

firefox158

---

fixed

People

(Reporter: wpt-sync, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Description

•

2 months ago

Sync web-platform-tests PR 62564 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/62564
Details from upstream follow.

Anne van Kesteren <annevk@annevk.nl> wrote:

Sanitizer: fix the javascript: URL tests and cover the default configuration

Follow-up to #62421, addressing https://github.com/web-platform-tests/wpt/pull/62421#discussion_r2937019033.

Restore the </script> end tag. #62421 removed it, so the tokenizer reaches EOF in the script data state, which sets the script element's already started to true. None of the tests in the file were running.

Stop running the shared html5lib expectations against { sanitizer: new Sanitizer() }. Those expectations assume a configuration that allows everything, as the comment #62421 replaced used to say. The default configuration's allow lists drop area, button, form, input, the SVG animation elements, nothref, attributeName and xlink:href, so 15 of the 30 testcases could not pass — for reasons that have nothing to do with javascriptURLs.

Test the default configuration on its own terms instead. HTML a/href and SVG a/href are the only pairs from the built-in navigating URL attributes list that the default configuration keeps at all, so for those, over { sanitizer: "default" } and { sanitizer: new Sanitizer() }, across setHTMLUnsafe() and parseHTMLUnsafe():

a javascript: URL is removed;

a non-javascript: URL in the same attribute is kept, which is both the control and a guard against the test silently passing on an absent element;

setJavascriptURLs(true) makes the unsafe methods keep the URL and the safe methods remove it anyway, which is what shows javascriptURLs is doing the work rather than the attribute allow list.

Also cover removeUnsafe(). A Sanitizer that has had removeUnsafe() called on it now runs against the shared expectations, since that is the case https://github.com/whatwg/html/pull/12898 was for and it was untested. It is compatible with those expectations: removeUnsafe() only touches the Unsafe-category elements, frame, SVG script/use and event handler content attributes, and none of the testcases involve any of those.

/cc @noamr @tannal @otherdaniel

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Updated

•

2 months ago

Component: web-platform-tests → DOM: Security

Product: Testing → Core

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Comment 1

•

2 months ago

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=72f00c35be1f2127c6fe4148aaeec48d71f640f3

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Comment 2

•

2 months ago

CI Results

Ran 9 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 30 tests and 8 subtests

Status Summary

Firefox

OK : 1[GitHub] 29[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt]
PASS : 271[GitHub] 606[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt]
FAIL : 162[GitHub] 192[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt]

Chrome

OK : 1
PASS : 271
FAIL : 162

Safari

ERROR: 1

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

/sanitizer-api/sanitizer-javascript-url.html [wpt.fyi]: OK [GitHub], SKIP [Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt] (Chrome: OK, Safari: ERROR)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/0, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/0, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/0, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/0, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/0, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/0, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/1, "<area href="javascript:alert(1)"></area>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/1, "<area href="javascript:alert(1)"></area>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/1, "<area href="javascript:alert(1)"></area>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/1, "<area href="javascript:alert(1)"></area>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/1, "<area href="javascript:alert(1)"></area>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/1, "<area href="javascript:alert(1)"></area>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/2, "<button formaction="javascript:alert(1)"></button>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/2, "<button formaction="javascript:alert(1)"></button>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/2, "<button formaction="javascript:alert(1)"></button>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/2, "<button formaction="javascript:alert(1)"></button>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/2, "<button formaction="javascript:alert(1)"></button>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/2, "<button formaction="javascript:alert(1)"></button>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/3, "<form action="javascript:alert(1)"></form>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/3, "<form action="javascript:alert(1)"></form>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/3, "<form action="javascript:alert(1)"></form>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/3, "<form action="javascript:alert(1)"></form>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/3, "<form action="javascript:alert(1)"></form>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/3, "<form action="javascript:alert(1)"></form>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/4, "<input formaction="javascript:alert(1)"></input>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/4, "<input formaction="javascript:alert(1)"></input>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/4, "<input formaction="javascript:alert(1)"></input>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/4, "<input formaction="javascript:alert(1)"></input>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/4, "<input formaction="javascript:alert(1)"></input>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/4, "<input formaction="javascript:alert(1)"></input>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/5, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/5, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/5, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/5, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/5, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/5, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/6, "<svg><a xlink:href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-navigating-url-attributes-list/6, "<svg><a xlink:href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/6, "<svg><a xlink:href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-navigating-url-attributes-list/6, "<svg><a xlink:href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/6, "<svg><a xlink:href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-navigating-url-attributes-list/6, "<svg><a xlink:href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase mathml/0, "<math><mrow href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase mathml/0, "<math><mrow href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase mathml/0, "<math><mrow href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase mathml/0, "<math><mrow href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase mathml/0, "<math><mrow href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase mathml/0, "<math><mrow href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase mathml/1, "<math><msqrt href="javascript:alert(1)"></msqrt></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase mathml/1, "<math><msqrt href="javascript:alert(1)"></msqrt></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase mathml/1, "<math><msqrt href="javascript:alert(1)"></msqrt></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase mathml/1, "<math><msqrt href="javascript:alert(1)"></msqrt></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase mathml/1, "<math><msqrt href="javascript:alert(1)"></msqrt></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase mathml/1, "<math><msqrt href="javascript:alert(1)"></msqrt></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase mathml/2, "<math><mtext href="javascript:alert(1)">Test</mtext></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase mathml/2, "<math><mtext href="javascript:alert(1)">Test</mtext></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase mathml/2, "<math><mtext href="javascript:alert(1)">Test</mtext></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase mathml/2, "<math><mtext href="javascript:alert(1)">Test</mtext></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase mathml/2, "<math><mtext href="javascript:alert(1)">Test</mtext></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase mathml/2, "<math><mtext href="javascript:alert(1)">Test</mtext></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase mathml/3, "<math><mrow xlink:href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase mathml/3, "<math><mrow xlink:href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase mathml/3, "<math><mrow xlink:href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase mathml/3, "<math><mrow xlink:href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase mathml/3, "<math><mrow xlink:href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase mathml/3, "<math><mrow xlink:href="javascript:alert(1)"></mrow></math>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/0, "<svg><animate attributeName="href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/0, "<svg><animate attributeName="href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/0, "<svg><animate attributeName="href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/0, "<svg><animate attributeName="href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/0, "<svg><animate attributeName="href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/0, "<svg><animate attributeName="href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/1, "<svg><animate attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/1, "<svg><animate attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/1, "<svg><animate attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/1, "<svg><animate attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/1, "<svg><animate attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/1, "<svg><animate attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/4, "<svg><animateTransform attributeName="href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/4, "<svg><animateTransform attributeName="href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/4, "<svg><animateTransform attributeName="href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/4, "<svg><animateTransform attributeName="href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/4, "<svg><animateTransform attributeName="href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/4, "<svg><animateTransform attributeName="href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/5, "<svg><animateTransform attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/5, "<svg><animateTransform attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/5, "<svg><animateTransform attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/5, "<svg><animateTransform attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/5, "<svg><animateTransform attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/5, "<svg><animateTransform attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/6, "<svg><set attributeName="href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/6, "<svg><set attributeName="href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/6, "<svg><set attributeName="href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/6, "<svg><set attributeName="href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/6, "<svg><set attributeName="href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/6, "<svg><set attributeName="href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/7, "<svg><set attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase built-in-animating-url-attributes-list/7, "<svg><set attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/7, "<svg><set attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase built-in-animating-url-attributes-list/7, "<svg><set attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/7, "<svg><set attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase built-in-animating-url-attributes-list/7, "<svg><set attributeName="xlink:href"></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/0, "<a href="JaVaScRiPt:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/0, "<a href="JaVaScRiPt:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/0, "<a href="JaVaScRiPt:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/0, "<a href="JaVaScRiPt:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/0, "<a href="JaVaScRiPt:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/0, "<a href="JaVaScRiPt:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/1, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/1, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/1, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/1, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/1, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/1, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/2, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/2, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/2, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/2, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/2, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/2, "<a href=" javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/3, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/3, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/3, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/3, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/3, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/3, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/4, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/4, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/4, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/4, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/4, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/4, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/5, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/5, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/5, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/5, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/5, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/5, "<a href="java script:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/6, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/6, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/6, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/6, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/6, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/6, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/7, "<svg><a xlink:href="java script:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: { javascriptURLs: false } } testcase url-normalization/7, "<svg><a xlink:href="java script:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/7, "<svg><a xlink:href="java script:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({ javascriptURLs: false }) } testcase url-normalization/7, "<svg><a xlink:href="java script:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/7, "<svg><a xlink:href="java script:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer({}) } after removeUnsafe() testcase url-normalization/7, "<svg><a xlink:href="java script:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: "default" } default configuration, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: "default" } default configuration, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer() } default configuration, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer() } default configuration, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setJavascriptURLs(true) on the default configuration, "<a href="javascript:alert(1)"></a>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: "default" } default configuration, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: "default" } default configuration, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setHTMLUnsafe { sanitizer: new Sanitizer() } default configuration, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- parseHTMLUnsafe { sanitizer: new Sanitizer() } default configuration, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- setJavascriptURLs(true) on the default configuration, "<svg><a href="javascript:alert(1)"></a></svg>": FAIL (Chrome: FAIL)
- sanitizer.setJavascriptURLs() controls URL preservation in setHTMLUnsafe: FAIL (Chrome: FAIL)
- Template and ShadowRoot handling with javascriptURLs: FAIL (Chrome: FAIL)
/sanitizer-api/parsehtmlunsafe-with-trustedtypes.tentative.html [wpt.fyi]
- Document.parseHTMLUnsafe: createParserOptions can inject a sanitizer config: FAIL
- Document.parseHTMLUnsafe: passing TrustedParserOptions directly works: FAIL
- Document.parseHTMLUnsafe: createParserOptions returning 0 fails: FAIL
- Document.parseHTMLUnsafe: createParserOptions returning 123 fails: FAIL
- Document.parseHTMLUnsafe: createParserOptions returning "foo" fails: FAIL
/sanitizer-api/sanitizer-boolean-defaults.html [wpt.fyi]
- javascript URLs: FAIL
/sanitizer-api/sanitizer-config.html [wpt.fyi]
- SanitizerConfig javascriptURLs field.: FAIL
/sanitizer-api/sanitizer-default-config.html [wpt.fyi]
- Get the expected default config: FAIL
/sanitizer-api/sanitizer-modifiers.html [wpt.fyi]
- sanitizer.setJavascriptURLs(): FAIL
/sanitizer-api/sanitizer-processing-instructions.html [wpt.fyi]
- setHTMLUnsafe testcase agnostic/0, "<?target data?>": FAIL
- ShadowRoot.setHTMLUnsafe testcase agnostic/0, "<?target data?>": FAIL
- setHTML testcase agnostic/0, "<?target data?>": FAIL
- ShadowRoot.setHTML testcase agnostic/0, "<?target data?>": FAIL
- parseHTML testcase agnostic/0, "<?target data?>": FAIL
- parseHTMLUnsafe testcase agnostic/0, "<?target data?>": FAIL
- setHTMLUnsafe testcase agnostic/1, "<?target data?>": FAIL
- ShadowRoot.setHTMLUnsafe testcase agnostic/1, "<?target data?>": FAIL
- setHTML testcase agnostic/1, "<?target data?>": FAIL
- ShadowRoot.setHTML testcase agnostic/1, "<?target data?>": FAIL
- parseHTML testcase agnostic/1, "<?target data?>": FAIL
- parseHTMLUnsafe testcase agnostic/1, "<?target data?>": FAIL
- setHTMLUnsafe testcase agnostic/2, "<?Target data?>": FAIL
- ShadowRoot.setHTMLUnsafe testcase agnostic/2, "<?Target data?>": FAIL
- parseHTML testcase agnostic/2, "<?Target data?>": FAIL
- parseHTMLUnsafe testcase agnostic/2, "<?Target data?>": FAIL
- setHTMLUnsafe testcase agnostic/3, "<?target data?>": FAIL
- ShadowRoot.setHTMLUnsafe testcase agnostic/3, "<?target data?>": FAIL
- parseHTML testcase agnostic/3, "<?target data?>": FAIL
- parseHTMLUnsafe testcase agnostic/3, "<?target data?>": FAIL
- setHTMLUnsafe testcase agnostic/4, "<?target-1 data?><?target-2 data?>": FAIL
- ShadowRoot.setHTMLUnsafe testcase agnostic/4, "<?target-1 data?><?target-2 data?>": FAIL
- setHTML testcase agnostic/4, "<?target-1 data?><?target-2 data?>": FAIL
- ShadowRoot.setHTML testcase agnostic/4, "<?target-1 data?><?target-2 data?>": FAIL
- parseHTML testcase agnostic/4, "<?target-1 data?><?target-2 data?>": FAIL
- parseHTMLUnsafe testcase agnostic/4, "<?target-1 data?><?target-2 data?>": FAIL
- setHTMLUnsafe testcase agnostic/5, "<?target-1 data?><?target-2 data?>": FAIL
- ShadowRoot.setHTMLUnsafe testcase agnostic/5, "<?target-1 data?><?target-2 data?>": FAIL
- setHTML testcase agnostic/5, "<?target-1 data?><?target-2 data?>": FAIL
- ShadowRoot.setHTML testcase agnostic/5, "<?target-1 data?><?target-2 data?>": FAIL
- parseHTML testcase agnostic/5, "<?target-1 data?><?target-2 data?>": FAIL
- parseHTMLUnsafe testcase agnostic/5, "<?target-1 data?><?target-2 data?>": FAIL
- setHTMLUnsafe testcase unsafe-only/0, "<?target data?>": FAIL
- ShadowRoot.setHTMLUnsafe testcase unsafe-only/0, "<?target data?>": FAIL
- parseHTMLUnsafe testcase unsafe-only/0, "<?target data?>": FAIL
- setHTMLUnsafe testcase unsafe-only/1, "<?target data?>": FAIL
- ShadowRoot.setHTMLUnsafe testcase unsafe-only/1, "<?target data?>": FAIL
- parseHTMLUnsafe testcase unsafe-only/1, "<?target data?>": FAIL
- setHTMLUnsafe testcase unsafe-only/2, "<div><?target data?></div>": FAIL
- ShadowRoot.setHTMLUnsafe testcase unsafe-only/2, "<div><?target data?></div>": FAIL
- parseHTMLUnsafe testcase unsafe-only/2, "<div><?target data?></div>": FAIL
/sanitizer-api/sanitizer-removeUnsafe.html [wpt.fyi]
- removeUnsafe removes the right elements and attributes: FAIL
- removeUnsafe with default config: FAIL
- removeUnsafe sets javascriptURLs to false: FAIL
/sanitizer-api/sethtml-with-declarative-shadow-root.tentative.html [wpt.fyi]
- shadowRoot.delegatesFocus does not propagate to the shadow root when shadowrootdelegatesfocus is removed by sanitizer: FAIL
- shadowRoot.serializable does not propagate to the shadow root when shadowrootserializable is removed by sanitizer: FAIL
- shadowRoot.clonable does not propagate to the shadow root when shadowrootclonable is removed by sanitizer: FAIL
- shadowRoot.referenceTarget does not propagate to the shadow root when shadowrootreferencetarget is removed by sanitizer: FAIL
- shadowRoot.customElementRegistry does not propagate to the shadow root when shadowrootcustomelementregistry is removed by sanitizer: FAIL
- shadowRoot.adoptedStyleSheets does not propagate to the shadow root when shadowrootadoptedstylesheets is removed by sanitizer: FAIL
/sanitizer-api/sethtml-with-trustedtypes-createParserOptions-null.tentative.html [wpt.fyi]
- TrustedParserOptions.sanitizer() is null when createParserOptions returns empty object: FAIL
- Element.setHTMLUnsafe: when TrustedParserOptions has null sanitizer, no sanitization occurs: FAIL
/sanitizer-api/sethtml-with-trustedtypes-createParserOptions.tentative.html [wpt.fyi]
- ShadowRoot.setHTMLUnsafe: passing a TrustedParserOptions overrides default policy: FAIL
- ShadowRoot.setHTMLUnsafe: policy with only createParserOptions allows raw strings when sanitizer is present: FAIL
- ShadowRoot.setHTMLUnsafe: TrustedParserOptions without sanitizer still requires createHTML: FAIL
- ShadowRoot.setHTMLUnsafe: exception in default createParserOptions prevents createHTML from running: FAIL
- ShadowRoot.setHTMLUnsafe: default policy createParserOptions with sanitizer prevents createHTML from running: FAIL
- Element.setHTMLUnsafe: passing a TrustedParserOptions overrides default policy: FAIL
- Element.setHTMLUnsafe: policy with only createParserOptions allows raw strings when sanitizer is present: FAIL
- Element.setHTMLUnsafe: TrustedParserOptions without sanitizer still requires createHTML: FAIL
- Element.setHTMLUnsafe: exception in default createParserOptions prevents createHTML from running: FAIL
- Element.setHTMLUnsafe: default policy createParserOptions with sanitizer prevents createHTML from running: FAIL
/sanitizer-api/sethtml-with-trustedtypes-immutable.tentative.html [wpt.fyi]
- createParserOptions doesn't mutate original object: FAIL
- createParserOptions doesn't mutate sanitizer object: FAIL
- TrustedParserOptions sanitizer clone testing with config input: FAIL
- TrustedParserOptions sanitizer clone testing with Sanitizer object input: FAIL
- TrustedParserOptions sanitizer clone testing with Preset string input: FAIL
/sanitizer-api/sethtml-with-trustedtypes.tentative.html [wpt.fyi]
- ShadowRoot.setHTMLUnsafe: createParserOptions can inject a sanitizer config: FAIL
- ShadowRoot.setHTMLUnsafe: createParserOptions can inject a sanitizer: FAIL
- ShadowRoot.setHTMLUnsafe: createParserOptions can override a sanitizer config: FAIL
- ShadowRoot.setHTMLUnsafe: createParserOptions returning 0 fails: FAIL
- ShadowRoot.setHTMLUnsafe: createParserOptions returning 123 fails: FAIL
- ShadowRoot.setHTMLUnsafe: createParserOptions returning "foo" fails: FAIL
- ShadowRoot.innerHTML: createParserOptions can inject a sanitizer config: FAIL
- ShadowRoot.innerHTML: createParserOptions can inject a sanitizer: FAIL
- ShadowRoot.innerHTML: createParserOptions can override a sanitizer config: FAIL
- ShadowRoot.innerHTML: createParserOptions returning 0 fails: FAIL
- ShadowRoot.innerHTML: createParserOptions returning 123 fails: FAIL
- ShadowRoot.innerHTML: createParserOptions returning "foo" fails: FAIL
- ShadowRoot.beforebegin: createParserOptions can inject a sanitizer config: FAIL
- ShadowRoot.beforebegin: createParserOptions can inject a sanitizer: FAIL
- ShadowRoot.beforebegin: createParserOptions can override a sanitizer config: FAIL
- ShadowRoot.beforebegin: createParserOptions returning 0 fails: FAIL
- ShadowRoot.beforebegin: createParserOptions returning 123 fails: FAIL
- ShadowRoot.beforebegin: createParserOptions returning "foo" fails: FAIL
- ShadowRoot.afterend: createParserOptions can inject a sanitizer config: FAIL
- ShadowRoot.afterend: createParserOptions can inject a sanitizer: FAIL
- ShadowRoot.afterend: createParserOptions can override a sanitizer config: FAIL
- ShadowRoot.afterend: createParserOptions returning 0 fails: FAIL
- ShadowRoot.afterend: createParserOptions returning 123 fails: FAIL
- ShadowRoot.afterend: createParserOptions returning "foo" fails: FAIL
- ShadowRoot.setHTMLUnsafe: createParserOptions with sanitizer prevents createHTML from running: FAIL
- ShadowRoot.setHTMLUnsafe: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- ShadowRoot.setHTMLUnsafe: exception in createHTML happens after createParserOptions runs: FAIL
- ShadowRoot.innerHTML: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- ShadowRoot.innerHTML: exception in createHTML happens after createParserOptions runs: FAIL
- ShadowRoot.beforebegin: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- ShadowRoot.beforebegin: exception in createHTML happens after createParserOptions runs: FAIL
- ShadowRoot.afterend: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- ShadowRoot.afterend: exception in createHTML happens after createParserOptions runs: FAIL
- Element.setHTMLUnsafe: createParserOptions can inject a sanitizer config: FAIL
- Element.setHTMLUnsafe: createParserOptions can inject a sanitizer: FAIL
- Element.setHTMLUnsafe: createParserOptions can override a sanitizer config: FAIL
- Element.setHTMLUnsafe: createParserOptions returning 0 fails: FAIL
- Element.setHTMLUnsafe: createParserOptions returning 123 fails: FAIL
- Element.setHTMLUnsafe: createParserOptions returning "foo" fails: FAIL
- Element.innerHTML: createParserOptions can inject a sanitizer config: FAIL
- Element.innerHTML: createParserOptions can inject a sanitizer: FAIL
- Element.innerHTML: createParserOptions can override a sanitizer config: FAIL
- Element.innerHTML: createParserOptions returning 0 fails: FAIL
- Element.innerHTML: createParserOptions returning 123 fails: FAIL
- Element.innerHTML: createParserOptions returning "foo" fails: FAIL
- Element.outerHTML: createParserOptions can inject a sanitizer config: FAIL
- Element.outerHTML: createParserOptions can inject a sanitizer: FAIL
- Element.outerHTML: createParserOptions can override a sanitizer config: FAIL
- Element.outerHTML: createParserOptions returning 0 fails: FAIL
- Element.outerHTML: createParserOptions returning 123 fails: FAIL
- Element.outerHTML: createParserOptions returning "foo" fails: FAIL
- Element.createContextualFragment: createParserOptions can inject a sanitizer config: FAIL
- Element.createContextualFragment: createParserOptions can inject a sanitizer: FAIL
- Element.createContextualFragment: createParserOptions can override a sanitizer config: FAIL
- Element.createContextualFragment: createParserOptions returning 0 fails: FAIL
- Element.createContextualFragment: createParserOptions returning 123 fails: FAIL
- Element.createContextualFragment: createParserOptions returning "foo" fails: FAIL
- Element.afterbegin: createParserOptions can inject a sanitizer config: FAIL
- Element.afterbegin: createParserOptions can inject a sanitizer: FAIL
- Element.afterbegin: createParserOptions can override a sanitizer config: FAIL
- Element.afterbegin: createParserOptions returning 0 fails: FAIL
- Element.afterbegin: createParserOptions returning 123 fails: FAIL
- Element.afterbegin: createParserOptions returning "foo" fails: FAIL
- Element.beforeend: createParserOptions can inject a sanitizer config: FAIL
- Element.beforeend: createParserOptions can inject a sanitizer: FAIL
- Element.beforeend: createParserOptions can override a sanitizer config: FAIL
- Element.beforeend: createParserOptions returning 0 fails: FAIL
- Element.beforeend: createParserOptions returning 123 fails: FAIL
- Element.beforeend: createParserOptions returning "foo" fails: FAIL
- Element.beforebegin: createParserOptions can inject a sanitizer config: FAIL
- Element.beforebegin: createParserOptions can inject a sanitizer: FAIL
- Element.beforebegin: createParserOptions can override a sanitizer config: FAIL
- Element.beforebegin: createParserOptions returning 0 fails: FAIL
- Element.beforebegin: createParserOptions returning 123 fails: FAIL
- Element.beforebegin: createParserOptions returning "foo" fails: FAIL
- Element.afterend: createParserOptions can inject a sanitizer config: FAIL
- Element.afterend: createParserOptions can inject a sanitizer: FAIL
- Element.afterend: createParserOptions can override a sanitizer config: FAIL
- Element.afterend: createParserOptions returning 0 fails: FAIL
- Element.afterend: createParserOptions returning 123 fails: FAIL
- Element.afterend: createParserOptions returning "foo" fails: FAIL
- Element.parseHTMLUnsafe: createParserOptions can inject a sanitizer config: FAIL
- Element.parseHTMLUnsafe: createParserOptions can inject a sanitizer: FAIL
- Element.parseHTMLUnsafe: createParserOptions can override a sanitizer config: FAIL
- Element.parseHTMLUnsafe: createParserOptions can remove a sanitizer: FAIL
- Element.parseHTMLUnsafe: createParserOptions returning 0 fails: FAIL
- Element.parseHTMLUnsafe: createParserOptions returning 123 fails: FAIL
- Element.parseHTMLUnsafe: createParserOptions returning "foo" fails: FAIL
- Element: createContextualFragment with createParserOptions(runScripts=false) does not run scripts: FAIL
- Element.setHTMLUnsafe: createParserOptions with sanitizer prevents createHTML from running: FAIL
- Element.setHTMLUnsafe: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- Element.setHTMLUnsafe: exception in createHTML happens after createParserOptions runs: FAIL
- Element.innerHTML: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- Element.innerHTML: exception in createHTML happens after createParserOptions runs: FAIL
- Element.outerHTML: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- Element.outerHTML: exception in createHTML happens after createParserOptions runs: FAIL
- Element.createContextualFragment: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- Element.createContextualFragment: exception in createHTML happens after createParserOptions runs: FAIL
- Element.afterbegin: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- Element.afterbegin: exception in createHTML happens after createParserOptions runs: FAIL
- Element.beforeend: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- Element.beforeend: exception in createHTML happens after createParserOptions runs: FAIL
- Element.beforebegin: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- Element.beforebegin: exception in createHTML happens after createParserOptions runs: FAIL
- Element.afterend: exception in createParserOptions is rethrown and prevents createHTML: FAIL
- Element.afterend: exception in createHTML happens after createParserOptions runs: FAIL
/sanitizer-api/sethtml-xml-document-sanitizer.tentative.html [wpt.fyi]
- innerHTML on XML document throws TypeError if default policy provides a sanitizer: FAIL
- outerHTML on XML document throws TypeError if default policy provides a sanitizer: FAIL
- insertAdjacentHTML on XML document throws TypeError if default policy provides a sanitizer: FAIL
- createContextualFragment on XML document throws TypeError if default policy provides a sanitizer: FAIL
- innerHTML on XML document created by DOMParser throws TypeError if default policy provides a sanitizer: FAIL
- innerHTML on XML document from XHR response throws TypeError if default policy provides a sanitizer: FAIL
/sanitizer-api/sethtml-xml-document.html [wpt.fyi]
- Testcase #0, shadow inside xmlDoc, shadowroot.setHTML("Hello!"): FAIL
- Testcase #1, shadow inside xmlDoc, shadowroot.setHTML("<br>"): FAIL
- Testcase #2, shadow inside xmlDoc, shadowroot.setHTML("<p>Hi</p>"): FAIL
- Testcase #3, shadow inside xmlDoc, shadowroot.setHTML("<iframe></iframe><p>text</p>"): FAIL

Tests Disabled in Gecko Infrastructure

/sanitizer-api/sanitizer-javascript-url.html [wpt.fyi]: OK [GitHub], SKIP [Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt] (Chrome: OK, Safari: ERROR)

Tom Schuster [:tschuster]

Updated

•

2 months ago

Blocks: 2068934

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Assignee

Updated

•

2 months ago

Depends on: 2071508

Pulsebot

Comment 3

•

2 months ago

Pushed by wptsync@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/5fd7f3250013 https://hg.mozilla.org/integration/autoland/rev/ad5922b76bf6 [wpt PR 62564] - Sanitizer: fix the javascript: URL tests and cover the default configuration, a=testonly

Goloman Adrian[:agoloman]

Comment 4

•

2 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/ad5922b76bf6

Status: NEW → RESOLVED

Closed: 2 months ago

status-firefox158: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 158 Branch

You need to log in before you can comment on or make changes to this bug.

Bugzilla

[wpt-sync] Sync PR 62564 - Sanitizer: fix the javascript: URL tests and cover the default configuration

Categories

(Core :: DOM: Security, task, P4)

Tracking

()

People

(Reporter: wpt-sync, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Crash Data

Security

(public)

User Story

Description

Updated

Comment 1

Comment 2

CI Results

Status Summary

Firefox

Chrome

Safari

Links

Details

New Tests That Don't Pass

Tests Disabled in Gecko Infrastructure

Updated

Updated

Comment 3

Comment 4