Re: [whatwg/dom] Declarative Shadow DOM (#831)

> even if people allow-list `<template>`, that should never make the sanitizer ignore the entire sub-tree, right? I.e. if I allow-list `<body`> does my entire document skip the sanitizer?

`<template>` makes its whole subtree inert, which is why ignoring the subtree would not have caused XSS, at least directly - there might be application-specific gadgets that would import the "scripty" nodes from under the template. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/issues/831#issuecomment-714600412