{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":603104092,"defaultBranch":"main","name":"WebKit","ownerLogin":"lukewarlow","currentUserCanPush":false,"isFork":true,"isEmpty":false,"createdAt":"2023-02-17T16:16:35.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/32498324?v=4","public":true,"private":false,"isOrgOwned":false},"refInfo":{"name":"","listCacheKey":"v0:1724863765.0","currentOid":""},"activityList":{"items":[{"before":"08e3862ffead2312763bcc764803e26a8512a3e7","after":"058490035b7206e865adae5ce3cb7d07367d93fd","ref":"refs/heads/trusted-types-Function-block-strings","pushedAt":"2024-09-09T16:25:36.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"lukewarlow","name":"Luke Warlow","path":"/lukewarlow","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32498324?s=80&v=4"},"commit":{"message":"Implement trusted types enforcement on Function constructor\nhttps://bugs.webkit.org/show_bug.cgi?id=273187\n\nReviewed by NOBODY (OOPS!).\n\nThis patch adds trusted types enforcement to the Function constructor as well as updating the eval implementation.\n\nThe canCompileStrings global method table function no longer takes a JSValue argument,\nthis is because it is now only called for untrusted input from eval.\n\nThe implementation of TT enforcement for both direct and indirect eval is updated to do more work in JSC.\nThe structure of the TrustedScript type is used by JSC to determine if an object should be evaluated,\nrather than always calling codeForEval. Only if the structures don't match is codeForEval called, this can happen\nif someone changes the instance properties such as for polyfills.\n\nThe canCompileStrings call is now only done if the input is known\nto be untrusted (raw string rather than TrustedScript argument).\n\nThe Function constructor is now also updated such that when TT enforcement is enabled through CSP, similar logic\ncomparing the arguments to the TrustedScript structure is used.\nIf not all of the arguments match the structure then they're not trusted so we fallback to calling canCompileStrings,\nwith a new ArgList atgument.\n\nThe ArgList is used to check if the arguments are modified trusted script objects, which are accepted providing the\nstringifier isn't modified.\n\nDebuggerEvalEnabler is also updated to disable trusted types and re-enable it, so that\nweb inspector can continue working on sites with TT enforced.\n\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-clips-sample.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/default-policy-callback-arguments.html:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-csp-tt-default-policy-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-csp-tt-default-policy-mutate-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-csp-tt-default-policy.html:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-csp-tt-no-default-policy-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-csp-tt-no-default-policy.html:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-function-constructor-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-function-constructor.html:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-no-csp-no-tt-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-no-csp-no-tt.html:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-with-permissive-csp-expected.txt:\n* Source/JavaScriptCore/API/JSAPIGlobalObject.cpp:\n(JSC::JSAPIGlobalObject::globalObjectMethodTable):\n* Source/JavaScriptCore/API/JSAPIGlobalObject.mm:\n(JSC::JSAPIGlobalObject::globalObjectMethodTable):\n* Source/JavaScriptCore/debugger/DebuggerEvalEnabler.h:\n(JSC::DebuggerEvalEnabler::DebuggerEvalEnabler):\n(JSC::DebuggerEvalEnabler::~DebuggerEvalEnabler):\n* Source/JavaScriptCore/interpreter/Interpreter.cpp:\n(JSC::eval):\n* Source/JavaScriptCore/jsc.cpp:\n* Source/JavaScriptCore/runtime/DirectEvalExecutable.cpp:\n(JSC::DirectEvalExecutable::create):\n* Source/JavaScriptCore/runtime/FunctionConstructor.cpp:\n(JSC::constructFunction):\n* Source/JavaScriptCore/runtime/GlobalObjectMethodTable.h:\n* Source/JavaScriptCore/runtime/IndirectEvalExecutable.cpp:\n(JSC::IndirectEvalExecutable::createImpl):\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::baseGlobalObjectMethodTable):\n(JSC::JSGlobalObject::init):\n(JSC::JSGlobalObject::visitChildrenImpl):\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n(JSC::JSGlobalObject::trustedScriptStructure):\n(JSC::JSGlobalObject::reportViolationForUnsafeEval):\n(JSC::JSGlobalObject::canCompileStrings):\n* Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/WebCore/bindings/js/JSDOMGlobalObject.cpp:\n(WebCore::JSDOMGlobalObject::codeForEval):\n(WebCore::JSDOMGlobalObject::canCompileStrings):\n(WebCore::JSDOMGlobalObject::trustedScriptStructure):\n* Source/WebCore/bindings/js/JSDOMGlobalObject.h:\n* Source/WebCore/bindings/js/JSDOMWindowBase.cpp:\n(WebCore::JSDOMWindowBase::globalObjectMethodTable):\n(WebCore::JSDOMWindowBase::reportViolationForUnsafeEval):\n(WebCore::JSDOMWindowBase::codeForEval): Deleted.\n(WebCore::JSDOMWindowBase::canCompileStrings): Deleted.\n* Source/WebCore/bindings/js/JSDOMWindowBase.h:\n* Source/WebCore/bindings/js/JSShadowRealmGlobalScopeBase.cpp:\n(WebCore::JSShadowRealmGlobalScopeBase::globalObjectMethodTable):\n(WebCore::JSShadowRealmGlobalScopeBase::reportViolationForUnsafeEval):\n(WebCore::JSShadowRealmGlobalScopeBase::codeForEval): Deleted.\n(WebCore::JSShadowRealmGlobalScopeBase::canCompileStrings): Deleted.\n* Source/WebCore/bindings/js/JSShadowRealmGlobalScopeBase.h:\n* Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp:\n(WebCore::JSWorkerGlobalScopeBase::globalObjectMethodTable):\n(WebCore::JSWorkerGlobalScopeBase::reportViolationForUnsafeEval):\n(WebCore::JSWorkerGlobalScopeBase::codeForEval): Deleted.\n(WebCore::JSWorkerGlobalScopeBase::canCompileStrings): Deleted.\n* Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.h:\n* Source/WebCore/bindings/js/JSWorkletGlobalScopeBase.cpp:\n(WebCore::JSWorkletGlobalScopeBase::globalObjectMethodTable):\n(WebCore::JSWorkletGlobalScopeBase::reportViolationForUnsafeEval):\n(WebCore::JSWorkletGlobalScopeBase::codeForEval): Deleted.\n(WebCore::JSWorkletGlobalScopeBase::canCompileStrings): Deleted.\n* Source/WebCore/bindings/js/JSWorkletGlobalScopeBase.h:\n* Source/WebCore/dom/TrustedType.cpp:\n(WebCore::canCompile):\n* Source/WebCore/dom/TrustedType.h:","shortMessageHtmlLink":"Implement trusted types enforcement on Function constructor"}},{"before":"3fd53169dbb51f646fb3a68f28b949bff751628a","after":"70f3e6217b85a8986f4ce4992b3ec444c2062960","ref":"refs/heads/main","pushedAt":"2024-09-09T16:25:23.000Z","pushType":"push","commitsCount":501,"pusher":{"login":"lukewarlow","name":"Luke Warlow","path":"/lukewarlow","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32498324?s=80&v=4"},"commit":{"message":"Unreviewed, revert 283302@main's change a bit since it broke internal builds\nhttps://bugs.webkit.org/show_bug.cgi?id=279366\nrdar://135552356\n\n* Source/JavaScriptCore/wasm/generateWasmOpsHeader.py:\n\nCanonical link: https://commits.webkit.org/283347@main","shortMessageHtmlLink":"Unreviewed, revert 283302@main's change a bit since it broke internal…"}},{"before":null,"after":"973603535a3871b0580d9a4391ee95166dbf29fc","ref":"refs/heads/focusoptions.focusvisible","pushedAt":"2024-08-28T16:49:25.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"lukewarlow","name":"Luke Warlow","path":"/lukewarlow","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32498324?s=80&v=4"},"commit":{"message":"Implement FocusOptions.focusVisible\nhttps://bugs.webkit.org/show_bug.cgi?id=242456\n\nReviewed by NOBODY (OOPS!).\n\nImplement the focusVisible item in FocusOptions.\n\nWhen this value is provided the focus visibility is enabled or disabled, if the value isn't provided\nwe fallback to an implementation defined value.\n\nAn assertion is removed as the case that's being protected against is now valid.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/processing-model/focusVisible-expected.txt:\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::setFocus):\n(WebCore::Element::setHasFocusVisible):\n(WebCore::Element::focus):\n* Source/WebCore/dom/FocusOptions.h:\n* Source/WebCore/dom/FocusOptions.idl:","shortMessageHtmlLink":"Implement FocusOptions.focusVisible"}},{"before":"8b4645f9b063d455693ac6b6097119db0971b364","after":"3fd53169dbb51f646fb3a68f28b949bff751628a","ref":"refs/heads/main","pushedAt":"2024-08-28T16:49:16.000Z","pushType":"push","commitsCount":61,"pusher":{"login":"lukewarlow","name":"Luke Warlow","path":"/lukewarlow","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32498324?s=80&v=4"},"commit":{"message":"[Unified PDF] After tab switching away and back, scrolled