Summary: An active <template> has for, src, or both.
for="name" patches a processing-instruction marker. An empty for inserts in place,
then the template is removed. src fetches a fragment. buffer inserts it in one
shot instead of streaming. External includes are sanitized unless sanitize="unsafe". Inline
templates are unsafe unless sanitize is set.
Explainer: fragment-include-explainer.md
Intent: Intent to Prototype: Declarative fragments
Chrome Platform Status: Declarative fragments
Proposal: Client side include · whatwg/html#2791
Tracking bug: 535664974
Behind chrome://flags/#enable-experimental-web-platform-features. A targeted inline
<template for="name"> is the shipped out-of-order streaming behavior and can pass here
even when src, buffer, and sanitize do not. Without the fragments
prototype, <template for="name" src> is an empty patch: it clears the marker and does not
fetch.
=== This is a demo of declarative fragments. ===
<template for><template for buffer><template for="name"><template for src><template src for><template src buffer>sanitize="unsafe" runs the fragment scriptsanitize strips the scriptsrc patch inside <table>Inline in-place template rendered.
Buffered in-place template rendered.
Targeted inline template rendered.
The same fragment contains a script. The default external include strips it.
sanitize="unsafe" lets it run. The inline template opts into sanitize.
sanitized inline, script did not run
src| Loading rows… |