diff --git a/files/en-us/_redirects.txt b/files/en-us/_redirects.txt index c577d7d08c0760e..512e44ab14ef9c4 100644 --- a/files/en-us/_redirects.txt +++ b/files/en-us/_redirects.txt @@ -3971,7 +3971,6 @@ /en-US/docs/HTMLSpanElement /en-US/docs/Web/API/HTMLSpanElement /en-US/docs/HTMLSpanElement_interface /en-US/docs/Web/API/HTMLSpanElement /en-US/docs/HTML_Intro2 /en-US/docs/Learn/HTML/Introduction_to_HTML -/en-US/docs/HTML_Santizer_API /en-US/docs/Web/API/HTML_Sanitizer_API /en-US/docs/HTML_in_XMLHttpRequest /en-US/docs/Web/API/XMLHttpRequest_API/HTML_in_XMLHttpRequest /en-US/docs/HTML_intro /en-US/docs/Learn/HTML/Introduction_to_HTML /en-US/docs/HTTP /en-US/docs/Web/HTTP @@ -8620,7 +8619,6 @@ /en-US/docs/Web/API/HTMLVideoElement/onleavepictureinpicture /en-US/docs/Web/API/HTMLVideoElement/leavepictureinpicture_event /en-US/docs/Web/API/HTMLVideoElement/requestPictureInPicture() /en-US/docs/Web/API/HTMLVideoElement/requestPictureInPicture /en-US/docs/Web/API/HTML_DOM /en-US/docs/Web/API/HTML_DOM_API -/en-US/docs/Web/API/HTML_Santizer_API /en-US/docs/Web/API/HTML_Sanitizer_API /en-US/docs/Web/API/HashChangeEvent/HashChangeEvent.oldURL /en-US/docs/Web/API/HashChangeEvent/oldURL /en-US/docs/Web/API/Headers/getAll /en-US/docs/Web/API/Headers/get /en-US/docs/Web/API/History.length /en-US/docs/Web/API/History/length @@ -9641,7 +9639,6 @@ /en-US/docs/Web/API/SVGPathElement/pathLength /en-US/docs/Web/API/SVGGeometryElement/pathLength /en-US/docs/Web/API/SVGStylable /en-US/docs/Web/API/SVGElement /en-US/docs/Web/API/SVGURIReference /en-US/docs/Web/SVG/Attribute/href -/en-US/docs/Web/API/Sanitizer/sanitizeFor /en-US/docs/Web/API/Sanitizer /en-US/docs/Web/API/Screen.availHeight /en-US/docs/Web/API/Screen/availHeight /en-US/docs/Web/API/Screen.availLeft /en-US/docs/Web/API/ScreenDetailed/availLeft /en-US/docs/Web/API/Screen.availTop /en-US/docs/Web/API/ScreenDetailed/availTop diff --git a/files/en-us/_wikihistory.json b/files/en-us/_wikihistory.json index e3102006de1b5ee..748312daf67bbb4 100644 --- a/files/en-us/_wikihistory.json +++ b/files/en-us/_wikihistory.json @@ -41897,10 +41897,6 @@ "Enn" ] }, - "Web/API/HTML_Sanitizer_API": { - "modified": "2020-12-13T12:18:13.088Z", - "contributors": ["Rumyra"] - }, "Web/API/HashChangeEvent": { "modified": "2020-10-15T21:29:11.207Z", "contributors": [ @@ -57509,18 +57505,6 @@ "Jeremie" ] }, - "Web/API/Sanitizer": { - "modified": "2020-12-13T12:17:05.573Z", - "contributors": ["Rumyra"] - }, - "Web/API/Sanitizer/Sanitizer": { - "modified": "2020-12-13T12:21:15.482Z", - "contributors": ["Rumyra"] - }, - "Web/API/Sanitizer/sanitize": { - "modified": "2020-12-13T12:25:31.511Z", - "contributors": ["Rumyra"] - }, "Web/API/Screen": { "modified": "2020-10-15T21:29:41.001Z", "contributors": [ diff --git a/files/en-us/web/api/element/index.md b/files/en-us/web/api/element/index.md index b13c33a8bf9779a..3244101dd42e9bd 100644 --- a/files/en-us/web/api/element/index.md +++ b/files/en-us/web/api/element/index.md @@ -279,8 +279,6 @@ _`Element` inherits methods from its parents {{DOMxRef("Node")}}, and its own pa - : Sets the value of the attribute with the specified name and namespace, from the current node. - {{DOMxRef("Element.setCapture()")}} {{Non-standard_Inline}} {{Deprecated_Inline}} - : Sets up mouse event capture, redirecting all mouse events to this element. -- {{DOMxRef("Element.setHTML()")}} {{Experimental_Inline}} {{SecureContext_Inline}} - - : Parses and [sanitizes](/en-US/docs/Web/API/HTML_Sanitizer_API) a string of HTML and inserts into the DOM as a subtree of the element. - {{DOMxRef("Element.setPointerCapture()")}} - : Designates a specific element as the capture target of future [pointer events](/en-US/docs/Web/API/Pointer_events). - {{DOMxRef("Element.toggleAttribute()")}} diff --git a/files/en-us/web/api/element/innerhtml/index.md b/files/en-us/web/api/element/innerhtml/index.md index d33199b23373a7b..8a259eaa8c490e6 100644 --- a/files/en-us/web/api/element/innerhtml/index.md +++ b/files/en-us/web/api/element/innerhtml/index.md @@ -53,7 +53,6 @@ This lets you look at the HTML markup of the element's content nodes. Setting the value of `innerHTML` lets you easily replace the existing contents of an element with new content. > **Note:** This is a [security risk](#security_considerations) if the string to be inserted might contain potentially malicious content. -> When inserting user-supplied data you should always consider using {{domxref("Element.setHTML()")}} instead, in order to sanitize the content before it is inserted. For example, you can erase the entire contents of a document by clearing the contents of the document's {{domxref("Document.body", "body")}} attribute: @@ -142,7 +141,6 @@ el.innerHTML = name; // shows the alert For that reason, it is recommended that instead of `innerHTML` you use: -- {{domxref("Element.setHTML()")}} to sanitize the text before it is inserted into the DOM. - {{domxref("Node.textContent")}} when inserting plain text, as this inserts it as raw text rather than parsing it as HTML. > **Warning:** If your project is one that will undergo any form of security review, using `innerHTML` most likely will result in your code being rejected. @@ -248,6 +246,5 @@ You can see output into the log by moving the mouse in and out of the box, click - {{domxref("Node.textContent")}} and {{domxref("HTMLElement.innerText")}} - {{domxref("Element.insertAdjacentHTML()")}} - {{domxref("Element.outerHTML")}} -- {{domxref("Element.setHTML")}} - Parsing HTML or XML into a DOM tree: {{domxref("DOMParser")}} - Serializing a DOM tree into an XML string: {{domxref("XMLSerializer")}} diff --git a/files/en-us/web/api/element/sethtml/index.md b/files/en-us/web/api/element/sethtml/index.md deleted file mode 100644 index fa4e1ed28fd4022..000000000000000 --- a/files/en-us/web/api/element/sethtml/index.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: "Element: setHTML() method" -short-title: setHTML() -slug: Web/API/Element/setHTML -page-type: web-api-instance-method -status: - - experimental -browser-compat: api.Element.setHTML ---- - -{{APIRef("HTML Sanitizer API")}}{{SeeCompatTable}}{{SecureContext_Header}} - -The **`setHTML()`** method of the {{domxref("Element")}} interface is used to parse and sanitize a string of HTML and then insert it into the DOM as a subtree of the element. -It should be used instead of {{domxref("Element.innerHTML")}} for inserting untrusted strings of HTML into an element. - -The parsing process drops any elements in the HTML string that are invalid in the context of the current element, while sanitizing removes any unsafe or otherwise unwanted elements, attributes or comments. -The default `Sanitizer()` configuration strips out XSS-relevant input by default, including {{HTMLElement("script")}} tags, custom elements, and comments. -The sanitizer configuration may be customized using {{domxref("Sanitizer.Sanitizer","Sanitizer()")}} constructor options. - -## Syntax - -```js-nolint -setHTML(input, options) -``` - -### Parameters - -- `input` - - : A string defining HTML to be sanitized. -- `options` {{optional_inline}} - - - : An options object with the following optional parameters: - - - `sanitizer` - - : A {{domxref("Sanitizer")}} object which defines what elements of the input will be sanitized. - If not specified, the default {{domxref("Sanitizer")}} object is used. - -### Return value - -None (`undefined`). - -### Exceptions - -None. - -## Examples - -The code below demonstrates how to sanitize a string of HTML and insert it into the `Element` with an id of `target`. - -```js -const unsanitized_string = "abc