On 10/14/26 12:11 p.m., Chromestatus wrote:
*Contact emails*
[email protected]
*Specification*
https://github.com/whatwg/html/pull/12898
*Summary*
https://github.com/whatwg/html/pull/12898 Sanitizer API also sanitizes
javascript:-URLs, when they are used for navigation. This was
originally done as a side effect of any "safe" method that uses
Sanitizer, and omittted for any "unsafe" method. The HTML standard
recently regularized this and made this a developer-selectable option,
instead of a side-effect of a particular method. Behaviour when the
option is not used remains the same.
*Blink component*
Blink>SecurityFeature>SanitizerAPI
<https://issues.chromium.org/issues?q=customfield1222907:%22Blink%3ESecurityFeature%3ESanitizerAPI%22>
*Web Feature ID*
SanitizerAPI <https://webstatus.dev/features/SanitizerAPI>
*Motivation*
Previously, Sanitizer API already supported sanitizing
javascript:-URLs, but only for "safe" methods. This was awkward if
users wanted to use the "unsafe" methods for some reason, but still
wanted javascript:-URLs removed. Further discussion on:
https://github.com/whatwg/html/issues/12686
https://github.com/whatwg/html/pull/12898
*Initial public proposal*
/No information provided/
*TAG review*
/No information provided/
*TAG review status*
Not applicable
*Goals for experimentation*
None
*Risks*
*Interoperability and Compatibility*
/No information provided/
/Gecko/: No signal
I see this shipped in Firefox:
https://bugzilla.mozilla.org/show_bug.cgi?id=2068934#c9 - can you update
the chromestatus entry?
/WebKit/: No signal
Can we request a signal please?
/Web developers/: No signals
/Other signals/:
*WebView application risks*
Does this intent deprecate or change behavior of existing APIs, such
that it has potentially high risk for Android WebView-based applications?
/No information provided/
*Debuggability*
/No information provided/
*Will this feature be supported on all six Blink platforms (Windows,
Mac, Linux, ChromeOS, Android, and Android WebView)?*
No
*Is this feature fully tested by web-platform-tests
<https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md>?*
No
Why not?
*Flag name on about://flags*
/No information provided/
*Finch feature name*
/No information provided/
Is this just omitted?
*Non-finch justification*
/No information provided/
*Rollout plan*
Will ship enabled for all users
*Requires code in //chrome?*
False
*Estimated milestones*
Shipping on desktop 157
Shipping on Android 157
Shipping on WebView 157
*Anticipated spec changes*
Open questions about a feature may be a source of future web compat or
interop issues. Please list open issues (e.g. links to known github
issues in the project for the feature specification) whose resolution
may introduce web compat/interop risk (e.g., changing to naming or
structure of the API in a non-backward-compatible way).
None. (https://github.com/whatwg/html/pull/12898 already landed.)
*Link to entry on the Chrome Platform Status*
https://chromestatus.com/feature/5169798320357376?gate=6096251476115456
This intent message was generated by Chrome Platform Status
<https://chromestatus.com>.
--
You received this message because you are subscribed to the Google
Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to [email protected].
To view this discussion visit
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/6acfa9bd.6e0b2b3a.151e33.132f.GAE%40google.com
<https://groups.google.com/a/chromium.org/d/msgid/blink-dev/6acfa9bd.6e0b2b3a.151e33.132f.GAE%40google.com?utm_medium=email&utm_source=footer>.
--
You received this message because you are subscribed to the Google Groups
"blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/a/chromium.org/d/msgid/blink-dev/16c9311c-cb13-4b5e-8ec4-0d1f28ea2cdb%40chromium.org.
