Relax <select> parser

[josepharhar]

Request for Mozilla Position on an Emerging Web Specification

• Specification title: Relax <select> parser
• Specification or proposal URL (if available): Relax <select> parser whatwg/html#10557
• Explainer URL (if available): https://open-ui.org/components/customizableselect/
• Proposal author(s) (@-mention GitHub accounts): @josepharhar
• Caniuse.com URL (optional):
• Bugzilla URL (optional):
• Mozillians who can provide input (optional):
• WebKit standards-position: Relax <select> parser WebKit/standards-positions#414

Other information

whatwg/html#10310 (comment)

[zcorpan]

Per whatwg/html#10310 (comment) the web compat situation needs more clarity. But a parser change is needed here in order to support other elements in a custom select, and the direction proposed here seems like the best for web developers long-term.

I reviewed the security risk of this change in whatwg/html#10310 (comment)

Conclusion: sanitizers need to have general protection against mXSS, and so this change doesn't introduce new mXSS vectors, even though the parsed tree can be very different between new and legacy parsers.

I suggest position: positive.

@hsivonen should sign off here before setting a position label.

[hsivonen]

I think that it makes sense to take a positive position on finding out the Web compat constraints for the proposed select parsing per whatwg/html#10310 (comment) .

A caveat, though: Previously, I had looked only at changes to select parsing and had missed whatwg/html#10633 , which appears to be treated as part of the whole package. I'm worried about breaking the so far implied invariant that there is one DOM element node per non-erroneous (possibly implied) start tag. Even template, which changed the basic expectations of how markup corresponds to DOM constructs allows parsing conforming markup to a DOM tree and re-reserializing to round trip. selectedcontent causing one option start tag to result in two option element nodes breaks at least serialization round-trippability of conforming markup. I don't at this time have more concrete reasoning about what practical badness this can cause exactly, but this kind of departure from the (implied) invariants worries me, so I don't want to say "positive" about this particular aspect.

[zcorpan]

Marking as positive but without the selectedcontent element in scope, where the cloning aspect from parsing that @hsivonen raised above is not in scope for this issue.