Web Sanitizer API

Description

• The setHTML() method inserts HTML into the DOM in a way that prevents cross-site scripting attacks.
• The parseHTML() method of the Document object provides an XSS-safe method to parse and sanitize a string of HTML in order to create a new Document.

I will limit the scope to setHTML() and Document.parseHTML().

There is a separate Interop proposal for the streaming methods, so please also vote for that.

Specification

https://html.spec.whatwg.org/#html-sanitization

web-feature

https://web-platform-dx.github.io/web-features-explorer/features/sanitizer/

Test Links

https://wpt.fyi/results/sanitizer-api

Additional Signals

Webkit standard position: positive

This feature has been supported since Chrome and Edge version 146 and Firefox version 148.
This tweet has 445 likes.
This Bluesky post has 203 likes.
The Sanitizer API has 79 votes in the developer signals repo, making it one of the most popular features (eleventh place out of 358 features).

Start with the HTML specification's HTML sanitization section and review the sanitizer-api results on wpt.fyi. The scope is limited to setHTML() and Document.parseHTML(); done means Interop coverage reflects those methods, without taking on the separate streaming-methods proposal.