Clarify that <details open> fires the toggle event even if the open attribute is set from the parser #4500

emilio · 2019-04-03T15:06:10Z

https://html.spec.whatwg.org/#the-details-element says:

Whenever the open attribute is added to or removed from a details element, the user agent must queue a task that runs the following steps, which are known as the details notification task steps, for this details element:
[...]

That doesn't say what happens when the parser sets the attribute, so e.g., you load data:text/html,<details open ontoggle="alert(1)">.

Looks like all implementations are interoperable in this case, but it's not so obvious from the spec text, so should probably be clarified. I can write a test.

The text was updated successfully, but these errors were encountered:

domenic · 2019-04-03T15:09:02Z

Good catch. Can you think of anything clearer than just adding "(including by the parser)" to that sentence? It feels a bit unsatisfying, but I don't have any better ideas.

emilio · 2019-04-03T15:14:54Z

That sounds ok to me. web-platform-tests/wpt#16244 is the test for this.

annevk · 2019-04-08T13:42:19Z

It seems bad to me that this would dispatch in an XMLHttpRequest document or a HTML module. That could lead to some very surprising behavior and potentially attacks.

Closes #4500. Tests: web-platform-tests/wpt#16244 Also moves the task source inline, per #4506.

domenic · 2019-04-26T20:35:15Z

I've posted a PR for this at #4574 to align with all existing browsers. Are implementers interested in all changing? I'm skeptical of the value, but I want to be sensitive to @annevk's concerns, so pinging @cdumez / @rniwa @emilio @tkent-google.

emilio · 2019-04-27T12:04:31Z

We'd probably need data to prove that people are not relying on that behavior...

It's yet another XSS vector, but not sure if that's enough justification to change it (it's not more of an XSS vector than <img onerror> and such).

emilio · 2019-04-27T21:13:57Z

Oh re-reading my own comment, I guess <img onerror> doesn't trigger the load if the <img> is not connected, I guess that's what @annevk was arguing?

Is there another precedent for something like this?

annevk · 2019-04-30T12:21:05Z

There's no precedent, this is pretty bad. Having said that, I cannot get

client = new XMLHttpRequest()
client.open("GET", 'data:text/xml,<html xmlns="http://www.w3.org/1999/xhtml"><details open="" ontoggle="alert(1)"/></html>', false);
client.send();
console.log(client.responseXML);

to run script in browsers, so this will need more tests and more complicated behavior if we wanted to go down this route, right?

domenic · 2019-04-30T16:38:54Z

Scripting is disabled in XML responseDocs. The event fires, but you have to add the handler from outside. See web-platform-tests/wpt#16244 for an example.

tkent-google · 2019-05-07T07:59:40Z

I filed crbug.com/960252 for adding a new counter to Chrome.

tkent-google · 2019-11-06T22:56:04Z

I filed crbug.com/960252 for adding a new counter to Chrome.

Result: less than 0.0004% https://chromestatus.com/metrics/feature/timeline/popularity/2978

I think we can change this behavior.

annevk · 2019-11-07T09:02:13Z

I'd propose we add "is browsing-context connected" to the conditions for queuing the task to fire the event.

domenic · 2023-09-15T15:45:32Z

At TPAC 2023 we discussed this and are generally OK with firing events from the parser. I'll work on driving #4574 and web-platform-tests/wpt#16244 to completion.

Closes #4500. Tests: web-platform-tests/wpt#16244 Also moves the task source inline, per #4506.

Closes #4500.

whatwg/html#4500

Closes #4500.

… event even from the parser., a=testonly Automatic update from web-platform-tests HTML: Test that <details open> fires the event even from the parser. whatwg/html#4500 -- wpt-commits: 06854ec7854c9061b84a8d675ff6fb8f0dcd08fc wpt-pr: 16244

… event even from the parser., a=testonly Automatic update from web-platform-tests HTML: Test that <details open> fires the event even from the parser. whatwg/html#4500 -- wpt-commits: 06854ec7854c9061b84a8d675ff6fb8f0dcd08fc wpt-pr: 16244 UltraBlame original commit: 93d1a7cfc9b50da825cb82bd72fabbd30218c41f

… event even from the parser., a=testonly Automatic update from web-platform-tests HTML: Test that <details open> fires the event even from the parser. whatwg/html#4500 -- wpt-commits: 06854ec7854c9061b84a8d675ff6fb8f0dcd08fc wpt-pr: 16244

… event even from the parser., a=testonly Automatic update from web-platform-tests HTML: Test that <details open> fires the event even from the parser. whatwg/html#4500 -- wpt-commits: 06854ec7854c9061b84a8d675ff6fb8f0dcd08fc wpt-pr: 16244 UltraBlame original commit: 582cc4d01280d499d3511ee56ad2d302c64758af

emilio mentioned this issue Apr 3, 2019

HTML: Test that <details open> fires the event even from the parser. web-platform-tests/wpt#16244

Merged

annevk added the clarification Standard could be clearer label Apr 5, 2019

domenic added a commit that referenced this issue Apr 26, 2019

Clarify that <details> toggle events happen during parsing

87ba779

Closes #4500. Tests: web-platform-tests/wpt#16244 Also moves the task source inline, per #4506.

domenic mentioned this issue Apr 26, 2019

Clarify that <details> toggle events happen during parsing #4574

Merged

5 tasks

This was referenced Aug 10, 2020

Dialog should be better-behaved on misuse, probably #5802

Open

Added find-in-page definitions #5770

Merged

domenic mentioned this issue Feb 23, 2022

Display Ordering: will this cause open="" attributes to get removed during HTML parsing? mfreed7/popup#5

Closed

mfreed7 mentioned this issue Mar 16, 2022

[popup] Display Ordering: will this cause open="" attributes to get removed during HTML parsing? openui/open-ui#494

Closed

domenic self-assigned this Sep 15, 2023

past mentioned this issue Sep 19, 2023

TPAC 2023 meeting whatwg/meta#284

Closed

domenic added a commit that referenced this issue Nov 1, 2023

Clarify that <details> toggle events happen during parsing

7f3966b

Closes #4500. Tests: web-platform-tests/wpt#16244 Also moves the task source inline, per #4506.

domenic added a commit that referenced this issue Nov 1, 2023

Clarify that <details> toggle events happen during parsing

8ff99f8

Closes #4500.

domenic pushed a commit to web-platform-tests/wpt that referenced this issue Nov 1, 2023

HTML: Test that <details open> fires the event even from the parser.

06854ec

whatwg/html#4500

domenic closed this as completed in #4574 Nov 2, 2023

domenic added a commit that referenced this issue Nov 2, 2023

Clarify that <details> toggle events happen during parsing

00a01ba

Closes #4500.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Clarify that <details open> fires the toggle event even if the open attribute is set from the parser #4500

Clarify that <details open> fires the toggle event even if the open attribute is set from the parser #4500

emilio commented Apr 3, 2019

domenic commented Apr 3, 2019

emilio commented Apr 3, 2019

annevk commented Apr 8, 2019

domenic commented Apr 26, 2019

emilio commented Apr 27, 2019

emilio commented Apr 27, 2019

annevk commented Apr 30, 2019 •

edited

Loading

domenic commented Apr 30, 2019

tkent-google commented May 7, 2019

tkent-google commented Nov 6, 2019

annevk commented Nov 7, 2019

domenic commented Sep 15, 2023

Clarify that <details open> fires the toggle event even if the open attribute is set from the parser #4500

Clarify that <details open> fires the toggle event even if the open attribute is set from the parser #4500

Comments

emilio commented Apr 3, 2019

domenic commented Apr 3, 2019

emilio commented Apr 3, 2019

annevk commented Apr 8, 2019

domenic commented Apr 26, 2019

emilio commented Apr 27, 2019

emilio commented Apr 27, 2019

annevk commented Apr 30, 2019 • edited Loading

domenic commented Apr 30, 2019

tkent-google commented May 7, 2019

tkent-google commented Nov 6, 2019

annevk commented Nov 7, 2019

domenic commented Sep 15, 2023

annevk commented Apr 30, 2019 •

edited

Loading