JavaScript: Add setHTMLUnsafe and parseHTMLUnsafe as XSS sinks

[sunnyeo]

Summary

Add two new HTML Sanitizer API methods as DOM-based XSS sinks:

• Element.setHTMLUnsafe(html) — Added to interpretsArgumentsAsHtml in DOM.qll, following the same pattern as insertAdjacentHTML and document.write. Receiver validation via isDomNode is inherited from DomMethodCallNode.

• Document.parseHTMLUnsafe(html) — Added to HtmlParserSink in DomBasedXssCustomizations.qll, following the same GlobalVarRefNode pattern as DOMParser.parseFromString. This is a static method on the Document class.

Both methods are part of the HTML Sanitizer API and are shipping in browsers (Chrome 124+, Firefox 148+). Unlike their safe counterparts (setHTML, parseHTML), these methods do not sanitize input and are therefore XSS sinks.

Changes

File	Change
DOM.qll	Add setHTMLUnsafe (arg 0) to interpretsArgumentsAsHtml
DomBasedXssCustomizations.qll	Add Document.parseHTMLUnsafe (arg 0) to HtmlParserSink

Design decisions

• setHTMLUnsafe in interpretsArgumentsAsHtml: This is a DOM element instance method (like insertAdjacentHTML, write), so DomMethodCallNode handles receiver validation via isDomNode.

• parseHTMLUnsafe in HtmlParserSink: This is a static method on the Document class (Document.parseHTMLUnsafe(html)). The Document class reference is not recognized by isDomNode (which tracks DOM node instances, not class constructors). We use GlobalVarRefNode to match the Document receiver, following the same pattern as DOMParser.parseFromString.

• ShadowRoot.setHTMLUnsafe: ShadowRoot is not currently tracked by domValueRef(), so isDomNode does not cover it. Adding ShadowRoot support to domValueRef() is a separate enhancement tracked independently.

References

• Element.setHTMLUnsafe() — MDN
• Document.parseHTMLUnsafe() — MDN
• Chromium commit: Protect setHTMLUnsafe and parseHTMLUnsafe with Trusted Types

[Copilot]

Pull request overview

This PR updates the JavaScript DOM-based XSS dataflow modeling to recognize two HTML Sanitizer API “unsafe” methods as sinks, ensuring flows into these APIs are reported as potential XSS.

Changes:

• Add Element.setHTMLUnsafe(html) (argument 0) as an HTML-interpreting DOM sink via interpretsArgumentsAsHtml.
• Add Document.parseHTMLUnsafe(html) (argument 0) as an HTML parser sink in HtmlParserSink.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssCustomizations.qll	Extends HtmlParserSink to include Document.parseHTMLUnsafe argument 0.
javascript/ql/lib/semmle/javascript/security/dataflow/DOM.qll	Extends DOM method-call HTML interpretation to include setHTMLUnsafe argument 0.