What to do about `<selectedcontent>`?

[mozfreddyb]

The new <selectedcontent> element establishes a somewhat new pattern. Similar to <svg use>, it can refer to existing content and clone it into itself.

If I read this correctly, the element allows new tricks where the attacker can now copy interesting content from the page into the sanitizer output, even if the sanitizer would not let it through.

[evilpie]

If I am understanding MDN/HTML correctly, the <selectedcontent> would be inside a <button> that would make it inert:

https://html.spec.whatwg.org/multipage/form-elements.html#the-button-element:~:text=If%20a%20button%20element%20is%20the%20first%20child%20which%20is%20an%20element%20of%20a%20select%20element%2C%20then%20it%20is%20inert.

[mozfreddyb]

For context, I raised the issue because of an XSS issue in DOMPurify. The advisory at GHSA-87xg-pxx2-7hvx was not yet public when I filed this.

I think we're OK?