2025-07-01 [00:28:51.0403] Hi! Do you know a debug tool such a firefox console to list trusted type tags in dom please? [05:01:22.0693] I work on Firefox and my team is responsible for Trusted Types, but I am not sure what your question is. [05:01:46.0473] Also, we don't really support Trusted Types yet. It's behind a pref in Nightly specifically because it doesn't fully work. [05:02:09.0576] Maybe #security:mozilla.org would be a better discussion channel. 2025-07-02 [22:56:55.0087] sideshowbarker: doing spring cleanup? [22:57:08.0120] * sideshowbarker: doing (very late) spring cleanup? [23:09:26.0045] Something like that yeah [23:14:47.0475] Whoa, someone left a lot of spam. Thanks for dealing with it Domenic! [02:55:27.0378] annevk: I'm going through Ladybird failures on the scoped custom element registry tests, and passing a registry to `Document.importNode()` isn't making sense to me. I see that Safari passes all of custom-elements/registries/Document-importNode.html, so maybe the implementation doesn't match the spec there. I'm looking at the second subtest there: `assert_true(document.importNode(document.createElement('some-element'), {customElementRegistry: scopedRegistry}) instanceof ScopedSomeElement);` `some-element` gets created using the document's registry. The test then expects `importNode()` to return a node that is using `scopedRegistry` instead. But, the registry is passed as `cloneNode()`'s `fallbackRegistry`, and that's only used if the node doesn't already have a registry. And it does have one! [03:00:02.0453] The idea of cloning a custom element and getting a different type of custom element seems strange to me but maybe I just need to read up on that more. [03:45:04.0101] Hello freddy I am happy to meat the core team! I was asking, how can I see in the inspector of the dom of mozilla if the result of an innerHTML or what else creation is TrustedTYpe or not pleqse? I need to check for xss. [03:45:12.0204] * Hello freddy I am happy to meet the core team! I was asking, how can I see in the inspector of the dom of mozilla if the result of an innerHTML or what else creation is TrustedTYpe or not pleqse? I need to check for xss. [04:33:01.0703] Hey, im reading through the spec and have a question. Hope this is the place to ask. The first point from the section on inserting a node into a parent is unclear to me: https://dom.spec.whatwg.org/#concept-node-insert It says: > Let nodes be nodeโ€™s children, if node is a DocumentFragment node; otherwise ยซ node ยป. What does "<< node >>" mean? [04:33:53.0799] It means it's a list. https://infra.spec.whatwg.org/#list [04:35:26.0148] that was fast, thank you! [04:36:30.0271] You're welcome! [05:19:22.0925] AtkinsSJ: that might well be a bug. I think we decided that `importNode()` wouldn't change the registry (except if its null). [05:24:33.0136] AtkinsSJ: yeah I don't think WebKit matches the specification. [14:43:41.0172] Once again not seeing anything agenda+ed for tomorrow's WHATNOT. Should I cancel it? [14:59:53.0177] Wfm ๐Ÿ™‚ 2025-07-03 [18:23:51.0036] What does it mean when the HTML spec says that something "is expected to act as follows"? Is it different from "should act as follows"? [18:54:13.0366] It's probably nothing special, but there is a specific case in which "expected" has a special meaning: https://html.spec.whatwg.org/#rendering [18:56:22.0613] Okay, thanks. [22:14:51.0034] jmdyck: it'd prolly be "must" not "should" [01:16:15.0766] Hello. I am looking for an rss feed as well as any way to get the latest update in w3c spec. I need to get the latest update for cyber security research. Do you know a such rss feeed please? [01:27:46.0703] Depends what exactly you're after but there's https://www.w3.org/news/feed/ [01:30:56.0630] The HTML spec (and a few others) are run by the WHATWG instead which is separate from W3C. I don't think there's a feed for those. What I've ended up doing is subscribing to the github repo for the specs I care about. There are feeds if needed, eg https://github.com/whatwg/html/commits/main.atom [01:34:10.0764] Would you like me open an issue about it? I'm not sure which repo to place it under. [02:01:30.0204] > <@atkinssj:serenityos.org> Depends what exactly you're after but there's https://www.w3.org/news/feed/ Sounds good. Letvme cgeck. [02:08:16.0911] AtkinsSJ: I am planning to create a WPT PR later today, based on https://github.com/WebKit/WebKit/pull/47489 [02:13:56.0820] > <@atkinssj:serenityos.org> Depends what exactly you're after but there's https://www.w3.org/news/feed/ I am after new features and if possible cybercsec alerts. [02:24:37.0464] The main.atom does not sounds presents in any repo https://github.com/tomnomnom/wappalyzer/commits/main.atom [02:25:46.0580] The "main" is the name of the branch. In some repos that's "main", others it's "master", or it could be something else. [02:26:19.0047] Looks like removing the branch name and just doing github.com/tomnomnom/wappalyzer/commits.atom works [02:31:50.0556] oh my god thank you for the trick! I had previously created a git diff script to grep latest updates [02:32:04.0701] there are 2 different purposes of course [02:33:27.0688] time to register to https://github.com/cure53/DOMPurify/commits/main.atom lol :) [02:56:54.0522] > <@atkinssj:serenityos.org> Depends what exactly you're after but there's https://www.w3.org/news/feed/ I like the feed. I am looking purely on new feature. If possiblevon features thzt enables js please? [04:42:58.0248] gogo: I've no idea, sorry [07:32:30.0915] cwilso: there actually was something on the agenda today ๐Ÿ˜‰ [07:32:51.0412] * cwilso: there actually was something on the agenda today ๐Ÿ˜‰ (mentioned in the doc) [07:33:54.0507] oh, wait, it was for 7/10 [07:33:57.0662] nm then [11:23:05.0139] no worry. I already advanced a lot of with the main branch updates! After I can subscribe to the feed [11:27:32.0415] sounds very good. I am a noob with rss feed. Is there any category? 2025-07-07 [08:59:10.0326] Hi all, just a friendly reminder to post any discussion topics for this Thursday's joint CSSWG/WHATWG/OpenUI task force meeting to the meeting agenda issue: https://github.com/whatwg/html/issues/11435 [09:22:04.0393] Just trying to look at the updates to https://dom.spec.whatwg.org/#valid-element-local-name and I feel like there's a discrepancy... The regexp (`/^(?:[A-Za-z][^\0\t\n\f\r\u0020/>]*|[:_\u0080-\u{10FFFF}][A-Za-z0-9-.:_\u0080-\u{10FFFF}]*)$/u`) validates that `a-\x01` returns `true` but as best as I can see the regexp does not follow the spec prose. Specifically the first match group of `/^[A-Za-z][^\0\t\n\f\r\u0020/>]*$/` says "must start with a letter, then should be any character _except_ these code points" but the prose says something quite different. Am I missing something obvious? /cc jarhar Domenic [09:23:07.0081] Oh... I see, the prose has branches for the whole string with an early return. [09:23:49.0129] I glossed over step 2.2. [09:34:37.0993] * Just trying to look at the updates to https://dom.spec.whatwg.org/#valid-element-local-name and I feel like there's a discrepancy... The regexp (`/^(?:[A-Za-z][^\0\t\n\f\r\u0020/>]*|[:_\u0080-\u{10FFFF}][A-Za-z0-9-.:_\u0080-\u{10FFFF}]*)$/u`) validates that `a-\x01` returns `true` but as best as I can see the regexp does not follow the spec prose. Specifically the first match group of `/^[A-Za-z][^\0\t\n\f\r\u0020/>]*$/` says "must start with a letter, then should be any character _except_ these code points" but the prose says something quite different. Am I missing something obvious? [13:30:16.0377] Hello fellow humans