Document: parseHTMLUnsafe() static method
Limited availability
This feature is not Baseline because it does not work in some of the most widely-used browsers.
Warning: This method parses its input as HTML, writing the result into the DOM. APIs like this are known as injection sinks, and are potentially a vector for cross-site-scripting (XSS) attacks, if the input originally came from an attacker.
You can mitigate this risk by always passing TrustedHTML objects instead of strings and enforcing trusted types.
See Security considerations for more information.
Note:
Document.parseHTML() should almost always be used instead of this method — on browsers where it is supported — as it always removes XSS-unsafe HTML entities.
The parseHTMLUnsafe() static method of the Document object is used to parse HTML input, optionally filtering unwanted HTML elements and attributes, in order to create a new Document instance.
Syntax
Document.parseHTMLUnsafe(input)
Document.parseHTMLUnsafe(input, options)
Parameters
input-
A
TrustedHTMLor string instance defining HTML to be parsed. optionsOptional-
An options object with the following optional parameters:
sanitizerOptional-
A
SanitizerorSanitizerConfigobject which defines what elements of the input will be allowed or removed. This can also be a string with the value"default", which applies aSanitizerwith the default (XSS-safe) configuration. If not specified, no sanitizer is used.Note that generally a
Sanitizeris expected than the to be more efficient than aSanitizerConfigif the configuration is to reused.
Return value
A Document.
Exceptions
TypeError-
This is thrown if:
htmlis passed a string when Trusted Types are enforced by a CSP and no default policy is defined.options.sanitizeris passed a:- value that is not a
Sanitizer,SanitizerConfig, or string. - non-normalized
SanitizerConfig(one that includes both "allowed" and "removed" configuration settings). - string that does not have the value
"default".
- value that is not a
Description
The parseHTMLUnsafe() static method can be used to create a new Document instance, optionally filter out unwanted elements and attributes.
The resulting Document will have a content type of "text/html", a character set of UTF-8, and a URL of "about:blank".
The input HTML may include declarative shadow roots.
If the string of HTML defines more than one declarative shadow root in a particular shadow host then only the first ShadowRoot is created — subsequent declarations are parsed as <template> elements within that shadow root.
parseHTMLUnsafe() doesn't perform any sanitization by default.
If no sanitizer is passed as a parameter, all HTML entities in the input will be injected.
Security considerations
The suffix "Unsafe" in the method name indicates that it does not enforce removal of all XSS-unsafe HTML entities (unlike Document.parseHTML()).
While it can do so if used with an appropriate sanitizer, it doesn't have to use an effective sanitizer, or any sanitizer at all!
The method is therefore a possible vector for Cross-site-scripting (XSS) attacks, where potentially unsafe strings provided by a user are injected into the DOM without first being sanitized.
You should mitigate this risk by always passing TrustedHTML objects instead of strings, and enforcing trusted type using the require-trusted-types-for CSP directive.
This ensures that the input is passed through a transformation function, which has the chance to sanitize the input to remove potentially dangerous markup (such as <script> elements and event handler attributes), before it is injected.
Using TrustedHTML makes it possible to audit and check that sanitization code is effective in just a few places, rather than scattered across all your injection sinks.
You should not need to pass a sanitizer to the method when using TrustedHTML.
If for any reason you can't use TrustedHTML (or even better, setHTML()) then the next safest option is to use setHTMLUnsafe() with the XSS-safe default Sanitizer.
Specifications
| Specification |
|---|
| HTML # dom-parsehtmlunsafe |
Browser compatibility
Loading…
See also
Document.parseHTML()Element.setHTML()andElement.setHTMLUnsafe()ShadowRoot.setHTML()andShadowRoot.setHTMLUnsafe()DOMParser.parseFromString()for parsing HTML or XML into a DOM tree- HTML Sanitizer API