From #60, Needs to be defined
Group members: please +1/-1 so we can gauge consensus.
Decision: Security & privacy semantics and clarification?
Proposal: S&P semantics are part of this proposal, not a follow-up. For any structured path we specify: the injection model, that model output is untrusted and why DOM-to-DOM's invariant neutralizes it, and a pointer to the Sanitizer API rather than a bespoke escape mode. (This slots into the shared considerations in Writing Assistance APIs §6–§7, which the Translator/Language Detector spec defers to.)
From #60, Needs to be defined
Group members: please +1/-1 so we can gauge consensus.
Decision: Security & privacy semantics and clarification?
Proposal: S&P semantics are part of this proposal, not a follow-up. For any structured path we specify: the injection model, that model output is untrusted and why DOM-to-DOM's invariant neutralizes it, and a pointer to the Sanitizer API rather than a bespoke escape mode. (This slots into the shared considerations in Writing Assistance APIs §6–§7, which the Translator/Language Detector spec defers to.)