Add DOM wrappers for Element.setHTMLUnsafe, ShadowRoot.setHTMLUnsafe, and Document.parseHTMLUnsafe
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 147
- Forks
- 15
- PR merge metrics
- No merged PRs in 30d
Description
Would it make sense to add safevalues DOM wrappers for these newer HTML parsing APIs?
These APIs reached Baseline browser support in September 2025. They accept HTML input without sanitization and are standard XSS sinks, making them highly relevant to the same class of DOM injection and Trusted Types concerns that safevalues already mitigates for older sinks like innerHTML.
While these APIs are designed to be compatible with Trusted Types, safevalues/dom currently lacks the corresponding wrappers to handle them. Since setHTMLUnsafe is the only way to parse Declarative Shadow DOM content (which innerHTML ignores), providing these wrappers would help maintain a complete security model in modern web applications.
Happy to help with a PR if this is something you'd like to support.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in safevalues/dom by comparing the existing innerHTML wrappers and their Trusted Types handling. Review the three linked APIs—Element.setHTMLUnsafe, ShadowRoot.setHTMLUnsafe, and Document.parseHTMLUnsafe—and determine the corresponding wrapper behavior. Done means all three unsafe HTML parsing sinks have consistent safevalues coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100