Element.innerHTML - add info trusted types

[hamishwillee]

This updates the following properties to explain how they are used with TrustedTypes:

• Element.innerHTML
• Element.insertAdjacentHTML()

This is in progress:

• Add boilerplate
• Add TT information, including the new exception and tinyfill
• Restructured - this isn't to current templates. Need to move the guid-ish stuff either down as examples or up into description

This does not mention the sanitizer methods as alternatives since the setHTML() is not implemented anywhere, and the sanitizer in setHTMLUnsafe() is not yet implemented. We're in separate discussion on those and when they are in a release we can revisit.

Part of #37518 (tracking issue)

[hamishwillee]

This is interesting I guess. But it doesn't actually matter. If it did/does it should be in the description part.

[github-actions]

Preview URLs

• /en-US/docs/Web/API/Element/innerHTML
• /en-US/docs/Web/API/Element/insertAdjacentHTML

External URLs (3)

URL: /en-US/docs/Web/API/Element/innerHTML
Title: Element: innerHTML property

• https://github.com/cure53/DOMPurify (1 time) (Note! This may be a new URL 👀)
• https://research.securitum.com/dompurify-bypass-using-mxss/ (1 time) (Note! This may be a new URL 👀)

---

URL: /en-US/docs/Web/API/Element/insertAdjacentHTML
Title: Element: insertAdjacentHTML() method

• https://hacks.mozilla.org/2011/11/insertadjacenthtml-enables-faster-html-snippet-injection/ (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2025-07-21 07:07:10)

[hamishwillee]

FYI @lukewarlow @wbamberg - this is the trusted types update for Element.innerHTML. Luke, I've taken on board your comments about sanitizer not yet being implemented. I still mention the setHTMLUnsafe() because it allows set with shadow roots, but not as alternatives with sanitization. It should however be possible to graft that information on here quite easily.

All the examples use trustedHTML. This also shows the first live example use of the tinyfill in the docs. This is duplication with the main docs, but it feels very practical to me given the current state of trustedtypes.

[hamishwillee]

Decided to hide the tinyfill in this case. Do you think it should be here. Or perhaps a note "if trusted types not supported you should add a tinyfill".