w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
600 stars 70 forks source link

`getPropertyType()` needs a rewrite? #456

Closed lukewarlow closed 3 months ago

lukewarlow commented 7 months ago

Like https://github.com/w3c/trusted-types/issues/423 but for getPropertyType().

Neither getPropertyType() nor getAttributeType() are actually implemented as specced they both in reality use a hardcoded "map" it would be better to spec both of these as actually implemented. This will help future implementators but also help drive the point that if a new sink is added to the spec it needs adding to these maps too.