It'd be neat if Yozo automatically attached element internals throught .attachInternals(). Gotta be a bit careful with this one, since old versions of iOS Safari don't have it; probably a polyfill should be recommended in the docs page for it.
It'd be cleanest to expose an internals variable (or $.internals) within <script>, optionally in the template as well. Note that this would be a breaking change, since components that already use .attachInternals() will no longer be able to do so (calling it twice is an error).
Adding this internally has some "security" benefits; if an author wants a closed shadow root, but does not call .attachInternals(), then component users can call it, gaining access to a reference to the shadowRoot, making it essentially open.
If the shadow root is open, then having element internals available is not necessarily a security benefit but probably also not an issue. For consistency it'd be nice either way.
vrugtehagel
commented
2 weeks ago
It'd be neat if Yozo automatically attached element internals throught
.attachInternals(). Gotta be a bit careful with this one, since old versions of iOS Safari don't have it; probably a polyfill should be recommended in the docs page for it.It'd be cleanest to expose an
internalsvariable (or$.internals) within<script>, optionally in the template as well. Note that this would be a breaking change, since components that already use.attachInternals()will no longer be able to do so (calling it twice is an error).Adding this internally has some "security" benefits; if an author wants a closed shadow root, but does not call
.attachInternals(), then component users can call it, gaining access to a reference to theshadowRoot, making it essentially open.If the shadow root is open, then having element internals available is not necessarily a security benefit but probably also not an issue. For consistency it'd be nice either way.
Relevant issue: https://github.com/vrugtehagel/yozo/issues/18