trusted-types

trusted-types copied to clipboard

Trusted Types closure to replace fallback policy

6

Currently trusted types requires you to update each individual call site for specific policy usage OR you get one universal default policy. This is, I suspect, in many cases not...

lukewarlow

Figure out if we need `'trusted-script'` in `script-src`

8

`trusted-script` keyword [is used](https://wicg.github.io/trusted-types/dist/spec/index.html#trusted-script-csp-keyword) now for `javascript:` navigations and `eval` guarding. Since we've integrated with CSP logic, perhaps the keyword is now superfluous? If a website uses `eval` or `javacsript:`...

koto

Missing test for SVG href and getAttributeType function

1

There's no test coverage over the SVG null/xlink NS href attribute in getAttributeType, this should be addressed.

lukewarlow

<Element-setAttributeNS.html> contains commented out test and seems to duplicate other tests

2

https://searchfox.org/mozilla-central/rev/c26f7461fc2a51196b7f517c7f98a1e271dc9ec0/testing/web-platform/tests/trusted-types/Element-setAttributeNS.html#21-32 There seems to be duplication with https://searchfox.org/mozilla-central/source/testing/web-platform/tests/trusted-types/block-string-assignment-to-Element-setAttributeNS.html#12-23 too.

mbrodesser-Igalia

Fix IDL of getAttributeType and getPropertyType

1

- Makes namespace properties nullable DOMStrings *** Preview | Diff

lukewarlow

Rewrite metadata functions

3

- getAttributeType and getPropertyType now use lookup tables. Fixes #456 and #423 *** Preview | Diff

lukewarlow

Issue with script enforcement

13

Apologies if I'm missing something but I believe that the spec as currently written blocks any inline script elements from executing. https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts A new [[ScriptText]] slot is added and is...

lukewarlow

Add missing IDL changes to Parent and Child Node mixins from dom spec

13

Address #438 I haven't done the DOM parts change but have made a follow up issue for tracking that so it doesn't get lost cc @mbrodesser-Igalia *** Preview | Diff

lukewarlow

Function constructor and default policy

3

Follow up from #445 Currently the default policy gets "(function(foo\n) { \nbody\n})" or something along those lines aka a compiled function string. This requires that we pass through the fully...

lukewarlow

Integration with Shadow Realms?

8

I'm unfamiliar with [shadow realms](https://tc39.es/proposal-shadowrealm) as a whole but I see that it introduces some form of script evaluation, does this need to be covered by Trusted Types like eval...

lukewarlow