w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
586 stars 68 forks source link

Finalise spec mechanism for event handlers #520

Open lukewarlow opened 2 weeks ago

lukewarlow commented 2 weeks ago

As of #457 the spec uses the HTML "event handler content attribute" concept. Anne's feedback was that that was ambiguous and we should instead generate a fixed list to check inside of. This issue tracks generating that or an alternative.

cc @koto as spec editor you might know how best to deal with this.