FF140 escaping < and > to &lt; and &gt; in attributes when serializing HTML

[hamishwillee]

FF140 ships support for escaping < and > to < and > in attributes when serializing HTML in https://bugzilla.mozilla.org/show_bug.cgi?id=1962084. This affects all the obvious methods like innerHTML, outerHTML, getHTML etc.

This PR removes the info in the experimental features page (the addition to Relnote is in a separate PR).

I also added a note to the end of each of the affected methods pointing down to the browser compatibility for this feature. Note that the feature is non standard, but is expected to be standardized soon.

Related docs work can be tracked in #39628

[hamishwillee]

This is the only actual change in this page.

[github-actions]

Preview URLs (6 pages)

• /en-US/docs/Mozilla/Firefox/Experimental_features
• /en-US/docs/Web/API/Element/getHTML
• /en-US/docs/Web/API/Element/innerHTML
• /en-US/docs/Web/API/Element/outerHTML
• /en-US/docs/Web/API/ShadowRoot/getHTML
• /en-US/docs/Web/API/ShadowRoot/innerHTML

Flaws (1)

Note! 5 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Mozilla/Firefox/Experimental_features
Title: Experimental features in Firefox
Flaw count: 1

• broken_links:
  • Can't resolve /en-US/docs/Web/API/HTML_Sanitizer_API

External URLs (77)

URL: /en-US/docs/Mozilla/Firefox/Experimental_features
Title: Experimental features in Firefox

• https://bugzil.la/1057233 (1 time)
• https://bugzil.la/1099557 (1 time)
• https://bugzil.la/1190623 (1 time)
• https://bugzil.la/1223880 (1 time)
• https://bugzil.la/1225110 (1 time)
• https://bugzil.la/1280613 (1 time)
• https://bugzil.la/1312588 (1 time)
• https://bugzil.la/1318984 (1 time)
• https://bugzil.la/1391243 (1 time)
• https://bugzil.la/1461589 (1 time)
• https://bugzil.la/1539075 (1 time)
• https://bugzil.la/1602129 (1 time)
• https://bugzil.la/1617609 (1 time)
• https://bugzil.la/1676779 (1 time)
• https://bugzil.la/1676791 (1 time)
• https://bugzil.la/1687364 (1 time)
• https://bugzil.la/1697647 (1 time)
• https://bugzil.la/1703961 (1 time)
• https://bugzil.la/1734997 (1 time)
• https://bugzil.la/1736914 (1 time)
• https://bugzil.la/1737918 (1 time)
• https://bugzil.la/1737920 (1 time)
• https://bugzil.la/1750902 (1 time)
• https://bugzil.la/1754897 (1 time)
• https://bugzil.la/1794475 (1 time)
• https://bugzil.la/1794628 (1 time)
• https://bugzil.la/1804573 (1 time)
• https://bugzil.la/1807685 (1 time)
• https://bugzil.la/1808410 (1 time)
• https://bugzil.la/1809005 (1 time)
• https://bugzil.la/1817303 (1 time)
• https://bugzil.la/1823463 (1 time)
• https://bugzil.la/1838746 (1 time)
• https://bugzil.la/1853418 (1 time)
• https://bugzil.la/1855763 (1 time)
• https://bugzil.la/1867058 (1 time)
• https://bugzil.la/1883896 (1 time)
• https://bugzil.la/1884424 (1 time)
• https://bugzil.la/1884425 (1 time)
• https://bugzil.la/1886134 (1 time)
• https://bugzil.la/1886441 (1 time)
• https://bugzil.la/1888729 (1 time)
• https://bugzil.la/1889561 (1 time)
• https://bugzil.la/1891446 (1 time)
• https://bugzil.la/1900929 (1 time)
• https://bugzil.la/1901037 (1 time)
• https://bugzil.la/1905706 (1 time)
• https://bugzil.la/1906301 (1 time)
• https://bugzil.la/1912511 (1 time)
• https://bugzil.la/1917783 (1 time)
• https://bugzil.la/1917784 (1 time)
• https://bugzil.la/1920115 (1 time)
• https://bugzil.la/1931290 (1 time)
• https://bugzil.la/1934683 (1 time)
• https://bugzil.la/1950759 (1 time)
• https://bugzil.la/1951772 (1 time)
• https://bugzil.la/1953557 (1 time)
• https://bugzil.la/1954138 (1 time)
• https://bugzil.la/1954685 (1 time)
• https://bugzil.la/1963263 (1 time)
• https://bugzil.la/502258 (1 time)
• https://bugzil.la/558594 (1 time)
• https://bugzil.la/778617 (1 time)
• https://bugzil.la/917755 (1 time)
• https://bugzil.la/918189 (1 time)
• https://drafts.csswg.org/css-inline/ (1 time)
• https://en.wikipedia.org/wiki/Graphics_Processing_Unit (1 time)
• https://github.com/mozilla/explainers/tree/main/archive/ppa-experiment (1 time)
• https://github.com/whatwg/html/pull/7829 (1 time)
• https://jpeg.org/jpegxl/ (1 time)
• https://support.mozilla.org/en-US/kb/about-config-editor-firefox (1 time)
• https://support.mozilla.org/en-US/kb/privacy-preserving-attribution (1 time)
• https://w3c.github.io/ppa/ (1 time)
• https://wiki.mozilla.org/Origin_Trials (1 time)
• https://www.mozilla.org/en-US/firefox/channel/desktop/ (2 times)
• https://www.mozilla.org/en-US/firefox/developer/ (2 times)

---

URL: /en-US/docs/Web/API/Element/getHTML
Title: Element: getHTML() method

• https://research.securitum.com/dompurify-bypass-using-mxss/ (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2025-05-26 18:50:53)

[hamishwillee]

The text here seemed completely wrong - it isn't a reference. There is a lot more that can be said.

I don't want to say it in this PR because that would be out of scope for this task. I do expect to be back here though, as I am currently doing work on the HTLM sanitization API which tanjentially affects this. I will also be looking at it as I add docs on the injection sinks for TrustedTypes.

[pepelsbey]

Looks good! Thank you :)