Streaming support

[zcorpan]

See whatwg/html#8759 (comment)

The HTML parser spec is streaming (although the tree is sometimes mutated in interesting ways). In whatwg/html#2142 there's a proposal to add a streaming API for the parser.

If the sanitizer API should be usable with the streaming HTML parser API, then sanitization needs to also be streamable.

It seems possible to perform sanitization in the tree builder stage of the HTML parser: https://html.spec.whatwg.org/multipage/parsing.html#creating-and-inserting-nodes

[annevk]

Since parsing and sanitizing are tightly coupled in the current APIs this is no longer a concern.

[annevk]

There's renewed interest in streaming parsing APIs so we should probably keep this open for v2.

[otherdaniel]

There's renewed interest in streaming parsing APIs so we should probably keep this open for v2.

This was briefly discussed in yesterday's meeting. Generally, this looks good to me. Some initial opinions, without having thought this through:

• The present Sanitizer design is very HTML-parser-adjacent. It should be easy to apply it to whatever the HTML parser produces, in whatever granularity.
• Sanitizer looks at one node at a time; Elements and its attributes are considered together. There are no decisions that take several nodes into account. That should make it easy to apply Sanitizer to sub-trees or partial trees.
• The replaceWithChildren action does need to know its children. The decision is node-local, but the action itself requires that the node 'knows' its children. The 'driver loop' wants to know about templates and shadow hosts in order to recurse into them. This would likely need to be taken into account.
• The API was a bit unclear to me; but I'll guess if there's an option bag somewhere it could contain a SanitizerConfig. I wonder if it'd make sense to have safe/unsafe variants.

[zcorpan]

• The API was a bit unclear to me; but I'll guess if there's an option bag somewhere it could contain a SanitizerConfig. I wonder if it'd make sense to have safe/unsafe variants.

See WICG/declarative-partial-updates#42

[noamr]

There's renewed interest in streaming parsing APIs so we should probably keep this open for v2.

This was briefly discussed in yesterday's meeting.

That's great! I wasn't expecting this feature to be discussed before it was re-opened. Seems like you've achieved time travel.

Generally, this looks good to me. Some initial opinions, without having thought this through:

• The replaceWithChildren action does need to know its children. The decision is node-local, but the action itself requires that the node 'knows' its children. The 'driver loop' wants to know about templates and shadow hosts in order to recurse into them. This would likely need to be taken into account.

Yea, the streaming would have to be buffered until the element is closed.

• The API was a bit unclear to me; but I'll guess if there's an option bag somewhere it could contain a SanitizerConfig. I wonder if it'd make sense to have safe/unsafe variants.

This would either be an extension to setHTML or a similar variant with a different name.

I guess we wouldn't need a new API for the sanitizer itself, as it's just a builder of a policy, and we would only need new API for TrustedTypes. I think I understand this comment better now.

[foolip]

See also discussion over at w3c/trusted-types#594.

[annevk]

Edit: this comment was really about Trusted Types and it was slightly wrong. w3c/trusted-types#594 (comment) has the improved version.