| 09:02 | <nox> | annevk: In the "Otherwise" part of https://url.spec.whatwg.org/#relative-state we do "If url is special and c is U+005C (\), validation error, set state to relative slash state", |
| 09:02 | <nox> | but in https://url.spec.whatwg.org/#relative-slash-state we do the exact same validation error again. |
| 09:04 | <annevk> | nox: one error for each \ |
| 09:04 | <annevk> | nox: \\: two errors, \/: one error |
| 09:05 | <nox> | annevk: … I forgot we increase the pointer every time we change states. |
| 09:06 | <annevk> | nox: it's really about the loop, since you might not change state and it'll get increased |
| 09:06 | <nox> | Yeah |
| 10:33 | <smaug____> | unhandledrejection is weird |
| 10:33 | <smaug____> | and error prone |
| 10:35 | <smaug____> | if a web app has handler for that, and we make some new or even old API to return promises and reject, that may block the site to work if the site expects zero unhandledrejection events in order to work |
| 10:36 | <smaug____> | I could imagine mediaelement.play() to be used without need to deal with the promise |
| 13:56 | <devsnek> | I still don't get why someone trying to prevent XSS would use trusted types over createElement and such |
| 13:57 | <devsnek> | it reminds me of PHP people trying to sanitize queries before query substitution was added |
| 22:23 | <Krinkle> | *coughs* ahem, some people still do that in PHP, *cough* |
| 23:01 | <TabAtkins> | devsnek: The reason why is that createElement is terrible ergonomically. |
| 23:02 | <TabAtkins> | If you make a nice helper it suddenly becomes, frankly, *easier* to do things correctly and avoid all the escaping problems, but with the platform as written it's just so painful. |
| 23:07 | <Domenic> | I still think we should do https://web.archive.org/web/20160809024526/http://wiki.ecmascript.org/doku.php?id=harmony:quasis#secure_content_generation |
| 23:08 | <Domenic> | https://github.com/straker/html-tagged-template and https://github.com/whatwg/dom/issues/150 for more Friday night reading. |
| 23:39 | <devsnek> | TabAtkins: that's why we've got react and stuff though |
| 23:39 | <devsnek> | and I'd think security wins over ergonomics when discussing security features |
| 23:47 | <devsnek> | i've seen a few libs on npm for what domenic linked, the issue is that its hard to track strings of html around a large codebase compared to something like jsx where its an actual separate syntax from the surrounding script |