Re: [whatwg/dom] [Declarative Shadow DOM] How should we build the "opt-in" for fragment parsing of declarative Shadow DOM? (#912)

> It does not unfortunately. Trusted Types doesn't have cross-browser agreement.

@annevk, I wonder if there's a way to shape the `setInnerHTML()` opt-in argument such that **today**, opting in allows all contained declarative Shadow DOM content, and in the future (when the sanitizer-api is available), **not** opting in **still** allows contained declarative content, but with a first pass through the sanitizer?

@clelland after your nice BlinkOn talk today about Permissions Policy and Document Policy, I'm actually thinking this feature belongs squarely in Permissions Policy, not Document Policy. The policy restricts a "powerful" feature that can potentially enable scripts to bypass sanitizers. Would you agree?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/issues/912#issuecomment-730006585