search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
606 stars 74 forks source link

Event handler enforcement section wrong #474

Closed lukewarlow closed 5 months ago

lukewarlow commented 8 months ago

In the enforcement in event handler content attributes the sink name as specified does not match the rest of the spec.

sink being the result of concatenating the list « element’s local name, localName » with "." as a separator.

NOTE: For example, document.createElement('div').onclick = value will result in sink being 'div.onclick'.

The note is wrong because el.onclick = 'string' wont trigger a violation. But also the sink value here doesn't match anywhere else in the spec. I would expect Element onclick personally?

lukewarlow commented 7 months ago

Okay so after doing some more digging I think this section needs removing entirely and https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation needs updating to account for event handler attributes.