[w3c/DOM-Parsing] createContextualFragment() should do adopt node or some such (#65)

The HTML fragment parsing algorithm creates its own dummy document. Which means that
```
document.createRange().createContextualFragment(`<img src=x onerror=alert(1)>`)
```
should technically not alert as things are currently defined (images are only fetched in active documents). However, it does. In all browsers. And if you check the node document of the returned fragment it will match document, which is an active document.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/DOM-Parsing/issues/65