Intent to prototype: Escape "<" and ">" in attributes when serializing HTML
121 views
Skip to first unread message
Tom Schuster
unread,
Apr 23, 2025, 2:53:27 PMApr 23
Reply to author
Sign in to reply to author
Forward
Sign in to forward
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to dev-pl...@mozilla.org
Summary: We want to change the escaping of HTML attribute values to
include "<" (<) and ">" (>).
The fact that these characters are not escaped currently can lead to
security issues in HTML parsers and sanitizers. (Currently
Nightly-only)
Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1941347 Specification: https://github.com/whatwg/html/pull/6362 Standards Body: WhatWG
Platform coverage: everywhere
Preference: dom.security.html_serialization_escape_lt_gt
DevTools bug: n/a
Link to standards-positions discussion: none
Other browsers:
- Chrome: Rollout on Stable
https://github.com/whatwg/html/issues/6235#issuecomment-2729072764 - Webkit: no information
Tom Schuster
unread,
Apr 23, 2025, 3:01:49 PMApr 23
Reply to author
Sign in to reply to author
Forward
Sign in to forward
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message