search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
606 stars 74 forks source link

Should the APIs for creating a TrustedScript etc return a frozen object? #535

Open lukewarlow opened 4 months ago

lukewarlow commented 4 months ago

Currently the TrustedTypes aren't frozen objects so can be overridden. And then we need to account for the fact stuff like the stringifier can be overriden in implementations. We should probably change the spec to freeze the trusted types upon creation?

I'm not sure spec wise the correct way to do this. But I'm assuming we can call a freeze algorithm with the object even if there's not an IDL way to say this?

cc @koto

lukewarlow commented 4 months ago

This came up during implementation of eval protection within JSC. Where having a frozen object should help improve performance.