search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
600 stars 70 forks source link

Extract `Does sink type require trusted types?` to its own algorithm #450

Closed lukewarlow closed 7 months ago

lukewarlow commented 7 months ago

In it's current form it was rather hard to read through, this extracts it to the CSP section and fixes some grammar issues.

Preview | Diff

lukewarlow commented 7 months ago

cc @mbrodesser-Igalia does this seem like a reasonable change? Just something I came across when cleaning up a PR to webkit to implement it. I was trying to follow the spec as close as possible and that line tripped me up massively.

mbrodesser-Igalia commented 7 months ago

cc @mbrodesser-Igalia does this seem like a reasonable change? Just something I came across when cleaning up a PR to webkit to implement it. I was trying to follow the spec as close as possible and that line tripped me up massively.

The rendered diff above again contains more than the commit, e.g. https://pr-preview.s3.amazonaws.com/w3c/trusted-types/450/4e858f8...lukewarlow:a3aa7d5.html#require-trusted-types-for-csp-directive.

Perhaps the diff is rendered with a wrong branch? CC @koto

koto commented 7 months ago

Not sure what's with the preview, but there's not even a branch existing in here that would have a change in that directive.

Let's monitor, but merging the code in the meantime.

lukewarlow commented 7 months ago

Is it getting mixed up and looking at the master branch?

koto commented 7 months ago

master is way behind, it had other changes that didn't surface in the diff.

lukewarlow commented 7 months ago

@koto https://github.com/w3c/trusted-types/actions/runs/8007592166/job/21872070992 it seems the runner has failed and not published the update.

mbrodesser-Igalia commented 7 months ago

Not sure what's with the preview, but there's not even a branch existing in here that would have a change in that directive.

Let's monitor, but merging the code in the meantime.

Let's please fix this, see https://github.com/w3c/trusted-types/issues/455.