search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
606 stars 74 forks source link

"stringifying" in "Process value with a default policy" needs to be defined #541

Open mbrodesser-Igalia opened 3 months ago

mbrodesser-Igalia commented 3 months ago

In https://w3c.github.io/trusted-types/dist/spec/#abstract-opdef-process-value-with-a-default-policy step 2.

mbrodesser-Igalia commented 2 months ago

All callers of "Process value with a default policy" could pass it a string, so no stringification would be needed.

koto commented 2 weeks ago

Does that not require defining the stringification in https://w3c.github.io/trusted-types/dist/spec/#process-value-with-a-default-policy-algorithm anyway? This is the only callsite that does not already pass a string.

koto commented 2 weeks ago

Re: defining stringification for TrustedType objects, the spec uses the WebIDL stringifiers - they are not linked to WebIDL definitions, but that syntax seems to be recommended by Bikeshed.

Is there a more idiomatic way to define what should happen when a TrustedType needs converting to a string (by extracting a value from its data slot?)

cc @smaug----