Mirko Brodesser

icon company Igalia

Results 111 comments of Mirko Brodesser

should `null` & `undefined` for sinks requiring TT be a passthrough ?

> Consider the following scenario: > > ``` > setTimeout(null, 1); > ``` > > In a TT environment this would require `null` to be TrustedScript value. Say we define...

should `null` & `undefined` for sinks requiring TT be a passthrough ?

> Returning null or undefined (vs '') from default policy functions triggers a CSP violation, Why? Be aware that for values `null` and `undefined`, the default policy might return `'null'`...

should `null` & `undefined` for sinks requiring TT be a passthrough ?

> > > Returning null or undefined (vs '') from default policy functions triggers a CSP violation, > > > > > > Why? > > #414 has some context,...

Can we add no-op/report?

> Wouldn't the no-op version of TrustedTypes be: > > ```js > const noOpTtPolicy = trustedTypes.createPolicy("noOp", { > createHTML: (htmlString) => { > return htmlString; > }, > createScriptURL: (scriptUrlString)...

Can we add no-op/report?

@shhnjk: given your experience of deploying TT (https://github.com/w3c/trusted-types/issues/398#issuecomment-1910771081), what's your take on the necessity for a no-op mode?

Ensure at least one representative of all classes of injection sinks is guarded with TT

> > This allows shipping v1 without guarding all injection sinks. Covering the remaining sinks (#385) could be done in v2. > > I'm not sure I follow. Do you...

Ensure at least one representative of all classes of injection sinks is guarded with TT

> Does this issue need to remain open? No. > Idk if there's anything actionable from it? No.

Add test to <block-string-assignment-to-Element-setAttribute.html> which checks trusted types can be assigned to non-injection sinks

E.g. https://jsfiddle.net/6hj2xra7/

Add test to <block-string-assignment-to-Element-setAttribute.html> which checks trusted types can be assigned to non-injection sinks

https://w3c.github.io/trusted-types/dist/spec/#trusted-types mentions it's intended, so the test needs to be adapted.

Are all injection sinks covered by the spec?

Some injection sinks are covered implicitly by one change of the spec. E.g. `eval()` and `Function()` are covered by https://w3c.github.io/trusted-types/dist/spec/#csp-eval.