search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
600 stars 70 forks source link

WPTs for pre-navigation check of form-submission should be added #549

Open mbrodesser-Igalia opened 3 days ago

mbrodesser-Igalia commented 3 days ago

See e.g. https://jsfiddle.net/fhrpo2zj/2/.

The spec covers this, since "type" in [1] may be "form-submission" and [2] is fully exercised for that type.

CC @lukewarlow, @otherdaniel

[1] https://w3c.github.io/webappsec-csp/#should-block-navigation-request [2] https://w3c.github.io/trusted-types/dist/spec/#require-trusted-types-for-pre-navigation-check

mbrodesser-Igalia commented 1 day ago

Adding test is WIP at https://bugzilla.mozilla.org/show_bug.cgi?id=1921008.