Open mbrodesser-Igalia opened 4 months ago
https://github.com/w3c/trusted-types/pull/559 should clarify the language, I think. The is*
functions should not be called there directly, as they can be replaced by user's code, but IIUC the stringification behavior, which is defined for each Trusted Type should correctly extract the value, so the prose looks OK here without having to refer to the object internals? (see also https://github.com/w3c/trusted-types/issues/541#issuecomment-2449635866).
cc @petervanderbeken @smaug---- if there's a better way to write this up.
559 should clarify the language, I think.
Not sure, see https://github.com/w3c/trusted-types/pull/559#issuecomment-2470588228.
The
is*
functions should not be called there directly, as they can be replaced by user's code,
Correct.
but IIUC the stringification behavior, which is defined for each Trusted Type should correctly extract the value, so the prose looks OK here without having to refer to the object internals? (see also #541 (comment)).
cc @petervanderbeken @smaug---- if there's a better way to write this up.
https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-compliant-string-algorithm step 1 currently specifies "If input has type expectedType". What does that mean? It seems
isHTML
(https://w3c.github.io/trusted-types/dist/spec/#dom-trustedtypepolicyfactory-ishtml) /isScript
/isScriptURL
should be invoked.The callers of "Get Trusted Type compliant string", e.g.
someElement.insertAdjacentHTML
(https://html.spec.whatwg.org/#dom-parsing-and-serialization:dom-element-insertadjacenthtml) don't check that either so it should be checked somewhere.