w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
605 stars 74 forks source link

Should "Get Trusted Type compliant string" check `isHTML`/`isScript`/`isScriptURL`? #534

Open mbrodesser-Igalia opened 4 months ago

mbrodesser-Igalia commented 4 months ago

https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-compliant-string-algorithm step 1 currently specifies "If input has type expectedType". What does that mean? It seems isHTML (https://w3c.github.io/trusted-types/dist/spec/#dom-trustedtypepolicyfactory-ishtml) / isScript / isScriptURL should be invoked.

The callers of "Get Trusted Type compliant string", e.g.someElement.insertAdjacentHTML (https://html.spec.whatwg.org/#dom-parsing-and-serialization:dom-element-insertadjacenthtml) don't check that either so it should be checked somewhere.

koto commented 3 weeks ago

https://github.com/w3c/trusted-types/pull/559 should clarify the language, I think. The is* functions should not be called there directly, as they can be replaced by user's code, but IIUC the stringification behavior, which is defined for each Trusted Type should correctly extract the value, so the prose looks OK here without having to refer to the object internals? (see also https://github.com/w3c/trusted-types/issues/541#issuecomment-2449635866).

cc @petervanderbeken @smaug---- if there's a better way to write this up.

mbrodesser-Igalia commented 1 week ago

559 should clarify the language, I think.

Not sure, see https://github.com/w3c/trusted-types/pull/559#issuecomment-2470588228.

The is* functions should not be called there directly, as they can be replaced by user's code,

Correct.

but IIUC the stringification behavior, which is defined for each Trusted Type should correctly extract the value, so the prose looks OK here without having to refer to the object internals? (see also #541 (comment)).

cc @petervanderbeken @smaug---- if there's a better way to write this up.