From f39e6cf18a95e10615427acd269d1670e6b1be9d Mon Sep 17 00:00:00 2001 From: Johannes Marbach Date: Thu, 20 Jun 2024 15:06:44 +0200 Subject: [PATCH] MSC4159: Remove the deprecated name attribute on HTML anchor elements Signed-off-by: Johannes Marbach --- proposals/4159-remove-anchor-name.md | 73 ++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 proposals/4159-remove-anchor-name.md diff --git a/proposals/4159-remove-anchor-name.md b/proposals/4159-remove-anchor-name.md new file mode 100644 index 00000000000..2442ead67e2 --- /dev/null +++ b/proposals/4159-remove-anchor-name.md @@ -0,0 +1,73 @@ +# MSC4159: Remove the deprecated name attribute on HTML anchor elements + +Some message types in `m.room.message`, such as `m.text`, permit including HTML in the event content. +The spec [recommends] that clients limit the HTML they render to prevent attacks and provides a list +of permitted HTML tags and attributes. In particular, it allows using the `name` attribute on `a` tags. +This attribute is obsolete according to the [WHATWG HTML Living Standard] which is why this proposal +attempts to remove it from the spec. + + +## Proposal + +The `name` attribute was originally introduced to define targets for linking to specific parts of a +webpage. As an example, including the named anchor `bar` on a site allows you to append +the fragment `#foo` to the URL to cause your browser to scroll the anchor into view after loading the page. + +In modern versions of HTML this feature has been superseded by the `id` attribute which extends targeted +linking to more than just `a` tags. As a result, the `name` attribute is marked deprecated in [MDN]. + +> Was required to define a possible target location in a page. In HTML 4.01, `id` and `name` could +> both be used on ``, as long as they had identical values. +> +> Note: Use the global attribute `id` instead. + +Furthermore, it is also tracked as [obsolete but conforming] in WHATWG. + +> Authors should not specify the `name` attribute on `a` elements. If the attribute is present, its value +> must not be the empty string and must neither be equal to the value of any of the IDs in the element's +> tree other than the element's own ID, if any, nor be equal to the value of any of the other `name` +> attributes on `a` elements in the element's tree. If this attribute is present and the element has an ID, +> then the attribute's value must be equal to the element's ID. In earlier versions of the language, this +> attribute was intended as a way to specify possible targets for fragments in URLs. The `id` attribute +> should be used instead. + +On top of the deprecation of the `name` attribute in HTML, it is unclear what this feature would ever have +been used for in the context of Matrix. It appears highly undesirable to let events define targeted links +into a client's UI, not least because the value of the `name` attribute would need to be unique on the +entire page. Additionally, linking to specific events is already possible via [matrix.to URIs]. + +Therefore, the `name` attributed is removed from the list of permitted attributes on `a` tags without a +replacement. + + +## Potential issues + +Use cases that currently depend on the `name` attribute will be broken once the attribute is removed from +the allowed list. No concrete use cases are known as of writing, however. + + +## Alternatives + +None. + + +## Security considerations + +None. + + +## Unstable prefix + +None. + + +## Dependencies + +None. + + +[MDN]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a#name +[WHATWG HTML Living Standard]: https://html.spec.whatwg.org/ +[matrix.to URIs]: https://spec.matrix.org/v1.10/appendices/#matrixto-navigation +[obsolete but conforming]: https://html.spec.whatwg.org/#obsolete-but-conforming-features +[recommends]: https://spec.matrix.org/v1.10/client-server-api/#mroommessage-msgtypes