Re: [whatwg/dom] What is the "security policy" for adding new events and elements to the Web Platform? (#913)

@dfabulich thanks for the entertaining post, and the (better?) names for the two cases here. I agree with your points, mostly. You're right that new HTML elements, because of HTMLUnknownElement, should be ok to add. But new events, which come with "on*" content attributes, aren't. And as you rightly point out, we're adding new events all the time. I'm wondering if this issue has come up on the various threads discussing the APIs adding new events. (E.g. [Picture-in-Picture](https://www.w3.org/TR/picture-in-picture/#event-types), [WebXR](https://immersive-web.github.io/dom-overlays/#onbeforexrselect), [Web Bluetooth](https://webbluetoothcg.github.io/web-bluetooth/#events), etc.) From a quick search, it doesn't look like this issue has been brought up at all elsewhere. But perhaps I missed it. If so, I'm wondering what the mitigation was.

It was probably clear from my OP, but I'm definitely in the NGSLB camp. Blocking forward progress on a purely-hypothetical situation seems like not the right trade off here. **Of course**, if there's a real issue on real sites today, let's make sure we address it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/issues/913#issuecomment-722714729