search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
606 stars 74 forks source link

"pre-navigation check" uses "request’s clients's global object" which is null #548

Open mbrodesser-Igalia opened 1 month ago

mbrodesser-Igalia commented 1 month ago

Step 4 of [1]. It's passed a synthetic request from step 5 of [2].

CC @otherdaniel, @evilpie, @lukewarlow

[1] https://w3c.github.io/trusted-types/dist/spec/#require-trusted-types-for-pre-navigation-check [2] https://html.spec.whatwg.org/#the-javascript:-url-special-case

koto commented 1 month ago

That's https://github.com/whatwg/html/issues/4651. We don't have a client passed to the algorithm, but that also fails in CSP before that happens.