search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
586 stars 68 forks source link

Remove enforcement from embed and object elements #486

Closed lukewarlow closed 2 months ago

lukewarlow commented 3 months ago

See https://github.com/w3c/trusted-types/issues/305

Issues:

Preview | Diff

lukewarlow commented 3 months ago

If we decide to merge this we need to make a Chrome and WebKit bug for it and remove/update the tests that cover this.

koto commented 3 months ago

LGTM

lukewarlow commented 3 months ago

@koto should this wait as per our discussion the other day?

koto commented 3 months ago

We discussed internally at Google and think it's a safe change.

lukewarlow commented 2 months ago

I'm gonna go ahead and merge this change. Test updates will happen accordingly (already basically done just need to finish the webkit patch)