search

syntax-tree / hast-util-from-html-isomorphic

hast utility that turns HTML into a syntax tree (while being small in browsers)
https://unifiedjs.com
MIT License
8 stars 0 forks source link

template + innerHTML VS DOMParser for fragment #2

Closed JounQin closed 1 year ago

JounQin commented 1 year ago

Initial checklist

Problem

Which solution should be preferred?

Solution

https://github.com/rehypejs/rehype-dom/pull/19

Alternatives

N/A

remcohaszing commented 1 year ago

Hey, long time no see! :wave:

I think the method used here in hast-util-from-html-isomorphic is relatively elegant. As far as I can tell it works fine. I would love to hear about cases where the other method is preferred though.

wooorm commented 1 year ago

I believe the linked issue explains more. Using a template in the current document sends HTTP requests: https://github.com/rehypejs/rehype-dom/issues/18.

remcohaszing commented 1 year ago

I am seeing a network request when using the code from https://stackoverflow.com/questions/12747350/using-documentfragment-to-parse-html-without-sending-http-requests (linked from https://github.com/rehypejs/rehype-dom/issues/18), but not when using a <template> tag as is used in the current approach.

wooorm commented 1 year ago

Hmm, funky. Might be the template tag?

remcohaszing commented 1 year ago

Yes, I think so.

This HTML document triggers a request:

<!DOCTYPE html>
<html>
  <head>
    <meta charset="UTF-8" />
  </head>
  <body>
    <img src="./image.png" />
  </body>
</html>

This one doesn’t

<!DOCTYPE html>
<html>
  <head>
    <meta charset="UTF-8" />
  </head>
  <body>
    <template>
      <img src="./image.png" />
    </template>
  </body>
</html>
wooorm commented 1 year ago

@JounQin Then I think this can be closed?

wooorm commented 1 year ago

Closing, seems fine!

github-actions[bot] commented 1 year ago

Hi! This was closed. Team: If this was fixed, please add phase/solved. Otherwise, please add one of the no/* labels.

JounQin commented 10 months ago

Sure, I missed this issue for a long time.

I'm not for sure will template + innerHTML be XSSed? But I think DOMParser will never be?