diff --git a/spec/index.bs b/spec/index.bs
index 1d5c4cc..e859b3e 100644
--- a/spec/index.bs
+++ b/spec/index.bs
@@ -205,23 +205,6 @@ it's not easy to distinguish one from the other.
This document organizes the injection sinks into groups, based on the
capabilities that sinks in a given group have. [=Enforcement=] for groups is controlled via trusted-types-sink-group values.
-### HTML injection sinks ### {#html-injection-sinks}
-
-*This section is not normative.*
-
-HTML injection sinks parse input strings into a DOM tree. Since HTML parsers
-can create arbitrary elements, including scripts, and set arbitrary attributes,
-enabling the [=enforcement=] of any trusted-types-sink-group also implies
-enforcing types for HTML injection sinks.
-
-Examples of HTML injection sinks include:
-
- * Functions that parse & insert HTML strings into the document like
- {{InnerHTML/innerHTML|Element.innerHTML}},
- {{Element/outerHTML|Element.outerHTML}} setter, or {{Document/write|Document.write}}.
- * Functions that create a new same-origin {{Document}} with caller-controlled
- markup like {{DOMParser/parseFromString()}},
-
### DOM XSS injection sinks ### {#dom-xss-injection-sinks}
*This section is not normative.*
@@ -229,7 +212,7 @@ Examples of HTML injection sinks include:
DOM XSS injection sinks evaluate an input string value in a way that could
result in DOM XSS if that value is untrusted.
-Examples of include:
+Examples include:
* Setters for {{Element}} attributes that accept a URL of the code to load
like {{HTMLScriptElement/src!!attribute|HTMLScriptElement.src}},
@@ -238,6 +221,15 @@ Examples of include:
* Functions that execute code directly like `eval`,
* Navigation to 'javascript:' URLs.
+Since HTML parsers can create arbitrary elements, including scripts, and set arbitrary attributes,
+DOM XSS injection sinks also include HTML parsing sinks:
+
+ * Functions that parse & insert HTML strings into the document like
+ {{InnerHTML/innerHTML|Element.innerHTML}},
+ {{Element/outerHTML|Element.outerHTML}} setter, or {{Document/write|Document.write}}.
+ * Functions that create a new same-origin {{Document}} with caller-controlled
+ markup like {{DOMParser/parseFromString()}}.
+
Guarding DOM XSS injection sinks is controlled by the trusted-types-sink-group named 'script'.
## Trusted Types ## {#trusted-types}