w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
606 stars 73 forks source link

getAttributeType and getPropertyType should default to HTML namespace, not "" #381

Open smaug---- opened 11 months ago

smaug---- commented 11 months ago

Currently the algorithms oddly change empty string to HTML namespace. That prevents using the methods with elements which are in "" namespace (whether or not that is actual useful). But if the methods just defaulted to HTML namespace, then one could still explicitly pass "".

Even better would be to remove both methods, since it is unclear if they are needed.

koto commented 9 months ago

+1 to removing them, after confirming they see no significant enough usage.

lukewarlow commented 9 months ago

Based on discussion in #384 these potentially aren't going to be removed so it would be good to get clarification on the original question

fred-wang commented 3 weeks ago

This report was about elementNs.

getAttributeType() also has a attrNs param defaulting to the empty string and interpreting the empty string as null. I wonder whether we should do like https://dom.spec.whatwg.org/#dom-element-getattributens and change the IDL to use null as the default value. That won't change the behavior.

annevk commented 2 weeks ago

I think we should either make both namespace arguments optional or neither.