Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Should "Get Trusted Type compliant string" check isHTML/isScript/isScriptURL? #534

Open
mbrodesser-Igalia opened this issue Jul 11, 2024 · 0 comments
Milestone

Comments

@mbrodesser-Igalia
Copy link
Collaborator

https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-compliant-string-algorithm step 1 currently specifies
"If input has type expectedType". What does that mean? It seems isHTML (https://w3c.github.io/trusted-types/dist/spec/#dom-trustedtypepolicyfactory-ishtml) / isScript / isScriptURL should be invoked.

The callers of "Get Trusted Type compliant string", e.g.someElement.insertAdjacentHTML (https://html.spec.whatwg.org/#dom-parsing-and-serialization:dom-element-insertadjacenthtml) don't check that either so it should be checked somewhere.

@mbrodesser-Igalia mbrodesser-Igalia changed the title Should "Get Trusted Type compliant string" check isHTML/isScript/isScriptURL/`? Should "Get Trusted Type compliant string" check isHTML/isScript/isScriptURL/? Jul 11, 2024
@mbrodesser-Igalia mbrodesser-Igalia changed the title Should "Get Trusted Type compliant string" check isHTML/isScript/isScriptURL/? Should "Get Trusted Type compliant string" check isHTML/isScript/isScriptURL? Jul 11, 2024
@mbrodesser-Igalia mbrodesser-Igalia added this to the v1 milestone Jul 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant