search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
606 stars 74 forks source link

Add WPT that `createPolicy` which violates the `trusted-types` CSP directive fires a violation event for Windows (not Workers) #530

Open mbrodesser-Igalia opened 4 months ago

mbrodesser-Igalia commented 4 months ago

E.g. createPolicy("X"); with trusted-types 'none'".

https://w3c.github.io/trusted-types/dist/spec/#should-block-create-policy doesn't set the violation's element. Hence https://w3c.github.io/webappsec-csp/#report-violation step 3.2 sets target to the document. Step 3.3 fires the event.

CC @lukewarlow, @otherdaniel

lukewarlow commented 1 month ago

Fix for this here btw https://github.com/web-platform-tests/wpt/pull/47176