Skip to content

Update sanitizer-boolean-defaults to match current spec. #55959

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 13, 2025
+46 −24
Merged

Update sanitizer-boolean-defaults to match current spec. #55959

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f40e36c
Update sanitizer-boolean-defaults to match current spec.
otherdaniel Nov 10, 2025
a1c5ac4
Add test cases for attributes:, but without dataAttributes:
otherdaniel Nov 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 46 additions & 24 deletions sanitizer-api/sanitizer-boolean-defaults.tentative.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,20 +25,25 @@
return div.innerHTML.includes("<!--");
}

assert_false(new Sanitizer().get().comments, "1");
assert_true(new Sanitizer({}).get().comments, "2");
assert_true(new Sanitizer({comments: true}).get().comments, "3");
assert_false(new Sanitizer({comments: false}).get().comments, "4");
// Parameter-less constructor.
assert_false(new Sanitizer().get().comments);
assert_true(try_unsafe());
assert_false(try_safe());

assert_true(try_unsafe(), "5");
assert_true(try_unsafe({sanitizer:{}}), "6");
assert_true(try_unsafe({sanitizer:{comments:true}}), "7");
assert_false(try_unsafe({sanitizer:{comments:false}}), "8");
// Constructed from empty dictionary.
assert_true(new Sanitizer({}).get().comments);
assert_true(try_unsafe({sanitizer:{}}));
assert_false(try_safe({sanitizer:{}}));

assert_false(try_safe(), "9");
assert_false(try_safe({sanitizer:{}}), "10");
assert_true(try_safe({sanitizer:{comments:true}}), "11");
assert_false(try_safe({sanitizer:{comments:false}}), "12");
// Explicitly set to true.
assert_true(new Sanitizer({comments: true}).get().comments);
assert_true(try_unsafe({sanitizer:{comments:true}}));
assert_true(try_safe({sanitizer:{comments:true}}));

// Explicitly set to false.
assert_false(new Sanitizer({comments: false}).get().comments);
assert_false(try_unsafe({sanitizer:{comments:false}}));
assert_false(try_safe({sanitizer:{comments:false}}));
}, "comments");

// Data Attributes:
Expand All @@ -54,20 +59,37 @@
return div.innerHTML.includes("data-foo");
}

assert_false(new Sanitizer().get().dataAttributes, "1");
assert_true(new Sanitizer({}).get().dataAttributes, "2");
assert_true(new Sanitizer({dataAttributes: true}).get().dataAttributes, "3");
assert_false(new Sanitizer({dataAttributes: false}).get().dataAttributes, "4");
// Parameter-less constructor.
assert_false(new Sanitizer().get().dataAttributes);
assert_true(try_unsafe());
assert_false(try_safe());

// Constructed from empty dictionary: Canonicalization removes dataAttributes.
assert_equals(undefined, new Sanitizer({}).get().dataAttributes);
assert_true(try_unsafe({sanitizer:{}}));
assert_true(try_safe({sanitizer:{}}));

// Explicitly set to true.
const dataAttributes_is_true = {attributes:[], dataAttributes: true};
assert_true(new Sanitizer(dataAttributes_is_true).get().dataAttributes);
assert_true(try_unsafe({sanitizer:dataAttributes_is_true}));
assert_true(try_safe({sanitizer:dataAttributes_is_true}));

assert_true(try_unsafe(), "5");
assert_true(try_unsafe({sanitizer:{}}), "6");
assert_true(try_unsafe({sanitizer:{dataAttributes:true}}), "7");
assert_false(try_unsafe({sanitizer:{dataAttributes:false}}), "8");
// Explicitly set to false.
const dataAttributes_is_false = {attributes:[], dataAttributes: false};
assert_false(new Sanitizer(dataAttributes_is_false).get().dataAttributes);
assert_false(try_unsafe({sanitizer:dataAttributes_is_false}));
assert_false(try_safe({sanitizer:dataAttributes_is_false}));

assert_false(try_safe(), "9");
assert_false(try_safe({sanitizer:{}}), "10");
assert_true(try_safe({sanitizer:{dataAttributes:true}}), "11");
assert_false(try_safe({sanitizer:{dataAttributes:false}}), "12");
// dataAttributes not set.
// (This case is different from the "empty dictionary" case above, because
// constructing from an empty dictionary adds a removeAttributes key and thus
// dataAttributes is removed, too. But this case has an explicit attributes
// key and thus dataAttributes should be added by the canonicalization.)
const dataAttributes_is_not_set = {attributes:[]};
assert_true(new Sanitizer(dataAttributes_is_not_set).get().dataAttributes);
assert_true(try_unsafe({sanitizer:dataAttributes_is_not_set}));
assert_false(try_safe({sanitizer:dataAttributes_is_not_set}));
}, "data attributes");

</script>
Expand Down