Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
datalist-polyfill
Advanced tools
A minimal and dependency-free vanilla JavaScript datalist polyfill. Supports all standard's functionality as well as mimics other browsers behavior.
Update: Safari now supports the datalist
element at least basically, as announced earlier in 2019 with the latest release of Safari both for iOS and MacOS X. Yeah !!! Exciting news!
I'm planning to release a new major version soon to both cheer as well as accommodate their implementation.
This is a minimal and dependency-free vanilla JavaScript polyfill for the awesome datalist-functionality, that will bring joy and happiness into our lives :-)
<option>
stext
, email
, number
, search
, tel
and url
...input[type=email]
elements multiple
attribute.options
for datalist
elements and .list
for input
elementsoption
declarationsvalue
and label
valuesinput[type=url]
omitting the scheme part and performing intelligent matching on the domain namevalue
and the text
valuesdatalist
is selectedinput
select
ESC
ENTER
BACKSPACE
The polyfill was designed with the following concepts kept in mind:
Just integrate the JavaScript file into your code - et voilà.
You may optionally load via NPM or Bower:
$ npm install datalist-polyfill
$ bower install datalist-polyfill
Nothing really, just plug it in, it will should work out of the box.
This package is also enabling the .options
(for datalist
elements) and .list
(for input
elements) properties according to the specs.
If you set a title
-Attribute on the <datalist>
HTML tag, it would get used as label for the first disabled entry within the polyfilling select on non-touch interactions.
In case that you'd like to dynamically add or modify / create your HTML code, you're good to go with this polyfill, as it's based on event delegation and additionally using MutationObserver (IE11+) that makes your UI work easily - no refresh nor reinit function to call after DOM manipulation or something similar.
option
elementsIf you'd like to make a change to the integrated list of <option>
elements, feel free to either remove or add them right away - the list would get generated on the fly after the user typed in something into the <input>
field, so you're covered on this.
You can also disable <option>
elements by adding the disabled
attribute to the <option>
HTML tag if necessary.
value
and label
valuesAs the browser vendors (Google Chrome vs. the others) don't seem to be aligned on this topic, I've decided to enable the label
-attribute to serve as the definitive label being displayed, even if a value is being defined differing from the label. On different value
and text
values, both of them would get displayed within the suggestions, as Google Chrome does it. But if you define a differing label
-attribute, its value would get displayed exclusively (as all the other browsers do it) to give you some flexibility on how to define those suggestions. Check out the „Different ways of defining an option“ section on the demo page regarding this topic.
value
property on the option
elements for Microsoft IE 10 & IE 11 and EdgeAs explained in detail below in the section "Microsoft Internet Explorer 10 & 11 and Microsoft Edge", for fixing missing behaviour in IE 10+ and Edge we're manipulating the value
for the option
elements in those browser so you can't access them securely as a getter, but would need to take the original values out of data-originalvalue
.
Microsoft Edge doesn't trigger the input
event any more after selecting an item via mouseclick (on input
elements other than type of text
), even though that IE11 still did, nevermind ...
That for the optimizations on substring matching for Microsoft Edge specifically by #GH-39 (as explained further in the following "Microsoft Internet Explorer 10 & 11 and Microsoft Edge" section) need to get restricted to input[type="text"]
elements even only.
There might be possible solutions to even also achieve the expected behaviour on non-text-input elements - even though that I only could think about ugly solutions that I don't want to have within the polyfill and that might even also break existing CSS & JS architecture / selectors.
As mentioned with #GH-63, related to aspects reported via #GH-36 and #GH-39 (and in Microsoft Edges platform issues), it doesn't work in IE 10 & 11 as well as in Edge to "Search both the value and label, using substring matching; currently it searches both the value and label, but uses prefix matching".
As requested with #GH-36 we wanted to even also enrich the experience within the "newest" IE versions (10 & 11) and Edge browsers that provided basic support, but not the substring matching for users input. In this case the technical solution has been to manipulate the values in a way that the browser could actually handle that functionality as well, by including the users input at the beginning of the value after a substring matching to the original value, followed by a unique string for preventing any inconsistencies, followed by the original value itself, in this case for the sorting of the entries (this is mainly done in the updateIEOptions
function around line 191 to 200 of the code).
This actually leads to a different behavior for the developers on the value
property of each option
elements within the datalist
element for IE & Edge, but on the other hand provides a better UX for IE & Edge users by a consistent behavior for the user.
You'll need the declaration for the standard hidden
attribute, that you might already have included in case you're using normalize.css
. Otherwise just adapt it from there:
/**
* Add the correct
* display in IE 10-
*/
[hidden] {
display: none;
}
And you need to add a nesting select
element wrapped by a conditional comment into the datalist
element.
Please have a look at the demo page accordingly, the code is being listed at the beginning.
See the polyfill in action either by downloading / forking this repo and have a look at demos/index.html
and demos/ie9/index.html
, or at the hosted demo: https://mfranzke.github.io/datalist-polyfill/demos/ and https://mfranzke.github.io/datalist-polyfill/demos/ie9/
<form>
are missing, and I've left the latin letters and english expressions for the right to left text-direction example. But lets focus on the relevant tags that this polyfill is all about for the demo.label
-attribute different from Safari on Mac OS. This is being equalized during the handling of the label
-attributes-value for differing value
and label
values.<select>
element to polyfill the <datalist>
, as it brought most of the functionality, whereas I accepted that it doesn't behave and doesn't look equally.
<option>
elements.multiple
attribute, as this is most likely already what you're up to regarding appearance, but it does violate the form-follows-function concept and results in - surprise - the possibility for multiple selections, which isn't always <datalist>
elements kind of thing... Then the size
attribute came to my attention, which much better fits the requirements and behaves as designed quite perfectly.datalist
element be a direct follower of the input
element - and don't nest it into the label
in case that you're doing so with the input
(which you nevertheless shouldn't do in general, but hey, gods great zoo is great).WKWebView
instead of UIWebView
, as it supports datalist
right natively and the latter even also leads to a JavaScript error (thanks to @jscho13 for mentioning this).Supported by Christian, Johannes, @mitchhentges, @mertenhanisch, @ailintom, @Kravimir, @mischah, @hryamzik, @ottoville, @IceCreamYou, @wlekin, @eddr, @beebee1987, @mricherzhagen, @acespace90, @damien-git, @nexces, @Sora2455, @jscho13, @alexirion and @vinyfc93. Thank you very much for that, highly appreciated !
Cross-browser testing platform provided by CrossBrowserTesting
The following problems are mainly reported and listed on caniuse as well as due to issues flagged on Github.
Problem | IE9 | iOS | Safari < 12.1 | iOS WebView | Safari >= 12.1 | IE11+ | Edge | Firefox | Chrome | Chrome WebView |
---|---|---|---|---|---|---|---|---|---|---|
Basic functionality | ✔ Polyfill | ✔ via WKWebView | ✔ | #GH-33 | ||||||
long lists of items are unscrollable resulting in unselectable options | ✔ | fixed with v.69 | ✔ | |||||||
No substring matching for the suggestions | ✔ | ✔ by #GH-39 | ✔ | |||||||
`datalist` popups gets "emptied" when receiving focus via tab | ✔ | ✔ by #GH-49 | ✔ |
Personally I even also do like the "keep it simple" approach provided within the W3C specs even already.
But on the other hand this leads to an additional visible field, but doesn't emulate the (hopefully, fingers crossed) upcoming x-browser implementation and leaves unnecessary syntax for all of the clients that wouldn't even need it (anymore).
If you're trying out and using my work, feel free to contact me and give me any feedback. I'm curious about how it's gonna be used.
And if you do like this polyfill, please consider even also having a look at the other polyfill we've developed: https://github.com/mfranzke/loading-attribute-polyfill
This project exists thanks to all the people who contribute. [Contribute].
Become a financial contributor and help us sustain our community. [Contribute]
Support this project with your organization. Your logo will show up here with a link to your website. [Contribute]
FAQs
A minimal and dependency-free vanilla JavaScript datalist polyfill. Supports all standard's functionality as well as mimics other browsers behavior.
We found that datalist-polyfill demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.