Re: [whatwg/dom] Declarative Shadow DOM (#831)

> This would be a "parser-only" feature, and adding the shadowroot attribute to an existing `<template>` would have no effect.

Attribute injection, which is what this is responding to, means injecting them on the parser level.  So the fact that this is a parse-only feature is not a protection against attribute injection.

Specifically, if a page has a `<template>` and you manage to get `<script>` inside it, right now that is safe.  If you can also get this new attribute on the `<template>`, that is no longer safe...

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/issues/831#issuecomment-585580174