Update Trusted Types content attributes test #49473
Conversation
There was a problem hiding this comment.
In the commit message:
-
Perhaps link to Finalise spec mechanism for event handlers w3c/trusted-types#520 so we can continue the discussion there and update the test later.
-
I'm not sure the spec has a normative definition of "injection sink". I understand that https://w3c.github.io/trusted-types/dist/spec/#integration-with-dom changes setAttribute/setAttributeNS to call https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute and then anything that would return a non-null data would be an "injection sink". So as I read the spec, calling
element.setAttribute("onclick", unsafe)on an element with an exotic namespace (not HTML or SVG or MathML) provides an injection sink, and the unsafe value needs to be sanitized by the default policy, even though there is no IDL definition for this element or no corresponding content attribute defined for that element in any web spec. For WindowEventHandlers, see my inline comment.
...es/TrustedTypePolicyFactory-getAttributeType-event-handler-content-attributes.tentative.html
Outdated
Show resolved
Hide resolved
...es/TrustedTypePolicyFactory-getAttributeType-event-handler-content-attributes.tentative.html
Outdated
Show resolved
Hide resolved
lukewarlow
force-pushed
the
tt-content-attributes
branch
from
be965aa to
df88a3e
Compare
- Skip attributes that are in WPT IDL but are not implemented in browser IDL. - Add comment explaining why each set of attributes are included. encrypted-media event listeners are an interesting case, they're only a TT sink in Firefox currently but as specced they should be in all browsers, so I've kept the tests for them. See w3c/trusted-types#520 for further discussion on the spec.
lukewarlow
force-pushed
the
tt-content-attributes
branch
from
df88a3e to
7c3f738
Compare
I think "sink" as a concept is well understood. But yes the spec for event handlers is very wishy washy right now. I think being overly strict is probably fine (like your example). But still needs some work. |
…erfaceName This is a small refactoring of #49473 Instead of skipping unsupported attributes in the for loop, we filter them out when building the list. Technically, interfaceName is no longer used in the for loop, but we keep it in case that's needed for future setAttribute/setAttributeNS tests.
Remove WindowEventHandlers from IDL as they're not TT sinks.
Skip attributes that are in WPT IDL but are not implemented in browser IDL.
encrypted-media event listeners are an interesting case, they're only a TT sink in Firefox currently but as specced they should be in all browsers so I've kept the tests for them.
encrypted-media tests might need a follow up test change, or addition (to actually check they're enforced if need be).