Re: [whatwg/dom] Declarative Shadow DOM (#510)

We added templete element support to WebKit back in 2011 (even before the Blink fork by a Google enginner). Even as recently as a couple months ago, I was fixing security bugs related to template element in WebKit due to the way it moves the child nodes into an inert document.

The proposed semantics (of attaching a shadow root after parsing the start tag) is equally problematic because now the HTML tree builder algorithm has to be aware of shadow trees, and has to take it into account when looking at the list of open elements, etc... Because ShadowTree and Document are special root nodes of a DOM tree in WebKit (and Blink) which are directly referenced by every node in the tree, this would mean that we'd have to inspect and fix every HTML parser code to correctly update the root node (Document or ShadowRoot) referenced by a newly parsed node.

Similarly, we recently removed isindex tag which was a parser macro that expanded into a form element and an input element. This feature introduced numerous security bugs in our HTML parser due to the fact isindex itself doesn't generate an element, and removing the feature was considered a big security win. The proposed semantics of shadow element has this problematic behavior (since shadow isn't a real element).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/issues/510#issuecomment-372224104