search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
600 stars 70 forks source link

Change Script Enforcement Mechanism to use flags #533

Open lukewarlow opened 2 months ago

lukewarlow commented 2 months ago

Also add SVGScriptElement to spec

Fixes https://github.com/w3c/trusted-types/issues/483, https://github.com/w3c/trusted-types/issues/517

Preview | Diff

lukewarlow commented 2 months ago

@annevk one question I've got with this boolean approach. Does something like .innerText =a/nb cause multiple children changed steps invocations? Wondering if the <br> element generation might somehow mess things up?

Edit: Turns out the bug I found is a pre-existing interop bug

lukewarlow commented 2 months ago

If children changed steps are never called by the parser then I think I can just remove the new boolean and this PR is basically ready to go. I was under the impression they would be called by the parser but I don't think they are.

@domfarolino do you know off the top of your head if that's true? I know you've used them for the post connection steps work youve been doing

lukewarlow commented 2 months ago

I've updated this PR to remove the parserChange boolean because it appears it's not needed. Spec wise the children changed steps seem to never actually get called by the parser. So parserChange is always false (aka it's always an API).