← back to v157 · add-javascripturls-option-to-sanitizerconfig-and-sanitizer
conformance · v157
v157 · add-javascripturls-option-to-sanitizerconfig-and-sanitizer — conformance probe
9 assertions drawn from the spec. Each is a single contract the spec text makes. Pass/fail reflects what this browser executed; blocked means the contract was not run because it needs user mediation, hardware, or another unavailable precondition. Open the page in Chrome stable / canary / Firefox / Safari to compare.
0
pass
0
fail
0
blocked
9
total
| id | contract | kind | verdict | detail |
|---|---|---|---|---|
sanitizer-interface-exists |
The Sanitizer interface the option hangs off is exposed on the global object. spec ↗ | typeof | … | |
set-javascript-urls-method-exists |
Sanitizer.prototype.setJavascriptURLs is a function (the new mutating method). spec ↗ | typeof | … | |
safe-config-canonicalises-to-false |
A default (safe-preset) Sanitizer canonicalises javascriptURLs to false in get(). spec ↗ | script | … | |
explicit-true-respected-in-config |
SanitizerConfig accepts javascriptURLs: true and get() round-trips it. spec ↗ | script | … | |
setter-returns-changed-boolean |
setJavascriptURLs(allow) returns true only when the stored value changed (true, then false on the repeat, then true to flip back). spec ↗ | script | … | |
remove-unsafe-forces-false |
removeUnsafe() sets javascriptURLs back to false even when the config asked for true — safe methods therefore always strip javascript: URLs. spec ↗ | script | … | |
safe-sethtml-strips-javascript-href |
Element.setHTML() removes a javascript: href from an anchor (the unchanged safe-path default). spec ↗ | script | … | |
unsafe-optin-strips-with-sanitizer-proof |
setHTMLUnsafe() with { javascriptURLs: false } strips the javascript: href while an element-allowlist side effect proves the sanitizer actually ran (an ignored unknown dictionary member cannot pass this). spec ↗ | script | … | |
unsafe-explicit-true-preserves |
setHTMLUnsafe() with { javascriptURLs: true } preserves the javascript: href, with the same allowlist side effect proving the sanitizer ran. spec ↗ | script | … |