trusted-types

trusted-types copied to clipboard

How to bless asset references

1

The [TC39 asset reference](https://github.com/sebmarkbage/ecmascript-asset-references) +(@bmeck @sebmarkbage) separates information about modules from loading of modules. Ir provides new syntax for [static asset references]: ```js asset Foo from "foo"; // Now the...

mikesamuel

Consider adding a type for base.href

3

Extracted from #152: @briansmith: > I expect that most people who would use Trusted Types don't want `` to be used at all and so it should be easy to...

koto

In https://w3c.github.io/trusted-types/dist/spec/#abstract-opdef-create-a-trusted-type-from-literal , TrustedHTML is special-cased to do > Let templateNode be the results of [creating an element](https://dom.spec.whatwg.org/#concept-create-element) given "template", the [HTML namespace](https://infra.spec.whatwg.org/#html-namespace) and [current global object](https://html.spec.whatwg.org/multipage/webappapis.html#current-global-object)'s [associated Document](https://html.spec.whatwg.org/multipage/window-object.html#concept-document-window). but...

Ms2ger

Developer-centric research results about Trusted Types

2

Recently, we have conducted a study regarding development strategies and roadblocks of trusted types deployment for Web Developers which is going to be presented/published in August 2024 (Preprint: https://swag.cispa.saarland/papers/roth2024tt.pdf). Among...

rothsn

Creating a policy with policyName="" is possible, but can't be referred to by the "trusted-types" CSP directive

6

E.g. https://jsfiddle.net/q5kmL492/ is possible. https://w3c.github.io/trusted-types/dist/spec/#trusted-types-csp-directive requires the policy-name to consist of at least one character. That might be annoying when one writes multiple policies named `""` and wants to limit...

mbrodesser-Igalia

Why is "callback **this** value set to null" required in step 5 of "Get Trusted Type policy value"?

1

https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-policy-value-algorithm

mbrodesser-Igalia

Improve test coverage for DOM integration in WPT

8

* https://wpt.fyi/results/trusted-types/block-string-assignment-to-Element-setAttribute.html needs * test with an attribute (e.g. HTML's `srcdoc`) node created in a different realm. It should be rejected when imported and added to an iframe in the...

koto

Can we drop the default policy value changing from Eval, new Function() (and other usages of the dynamic code brand checks proposal)?

13

Following on from discussions recently with @caridy it's possible we could avoid the default policy fallback for eval (and Function() etc). This simplifies the TT spec slightly (not much though),...

lukewarlow

E.g., in Create a Trusted Type Policy it would be much clearer if the dictionary members were set using map syntax. It currently states properties are being set, which is...

annevk

Stringification of TrustedHTML with `null`-data needs to be specified

21

https://w3c.github.io/trusted-types/dist/spec/#abstract-opdef-create-a-trusted-type

mbrodesser-Igalia