sanitizer-polyfill
sanitizer-polyfill copied to clipboard
Insufficient feature detection in Chrome 105 Beta
Currently Chrome 105 Beta ships with a basic implmentation of the Sanitizer API, but keeps the .sanitize and .sanitizeFor methods hidden behind the enable-experimental-web-platform-features flag.
https://chromestatus.com/feature/5786893650231296
If this flag is not enabled the window.Sanitizer constructor exists, but the object it creates does not have the .sanatize and .sanitizeFor methods. The polyfill currently only checks if window.Sanitizer is a function to decide if it needs to polyfill the API. This means that in Chrome 105 Beta the polyfill is not applied and the .sanitize and .sanitizeFor are missing. Should the final Chrome 105 version ship like this a more complex feature detection is needed.
EDIT: Spell "sanitize" correctly :)
I believe we need to change what this polyfill does. We at Firefox and Chrome agree that we only want to ship the constructor and the setHTML bits at first.
I suppose this means we want to remove the sanitize and sanitizeFor methods on the constructor as well. (One could think of a clever way of disabling it which I wouldn't be opposed to. But we're also using version control so I don't see the need to keep it around much)
(P.S: You're spelling sanitize wrong a couple of times :))`
To resolve this, we shouldn't expose the sanitize... methods on the constructor.
We at Firefox and Chrome agree that we only want to ship the constructor and the setHTML bits at first.
In that case I agree with removing the .sanitize and .sanitizeFor methods from the polyfill for now.