trusted-types
trusted-types copied to clipboard
Should "Get Trusted Type compliant string" check `isHTML`/`isScript`/`isScriptURL`?
https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-compliant-string-algorithm step 1 currently specifies
"If input has type expectedType". What does that mean? It seems isHTML
(https://w3c.github.io/trusted-types/dist/spec/#dom-trustedtypepolicyfactory-ishtml) / isScript
/ isScriptURL
should be invoked.
The callers of "Get Trusted Type compliant string", e.g.someElement.insertAdjacentHTML
(https://html.spec.whatwg.org/#dom-parsing-and-serialization:dom-element-insertadjacenthtml) don't check that either so it should be checked somewhere.