Skip to content

Commit 04b9b37

Browse files
ziransunlukewarlow
ziransun
authored and
lukewarlow
committed
Implement trusted types integrations with DOM attribute APIs.
https://bugs.webkit.org/show_bug.cgi?id=270436 Reviewed by NOBODY (OOPS!). Implement the spec updates at whatwg/dom#1247 It also removes some expectations in GTK as the results should be in line with the general expectation file. * LayoutTests/TestExpectations: * LayoutTests/imported/w3c/web-platform-tests/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/trusted-types/GlobalEventHandlers-onclick-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/trusted-types/TrustedTypePolicyFactory-metadata.tentative-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setAttribute-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setAttributeNS-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-event-handlers-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-event-handlers.html: * LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-svg-script-set-href-expected.txt: * LayoutTests/platform/gtk/TestExpectations: * Source/WebCore/dom/Element.cpp: (WebCore::trustedTypesCompliantAttributeValue): (WebCore::Element::validateAttributeIndex const): (WebCore::Element::toggleAttribute): (WebCore::Element::setAttribute): (WebCore::Element::setElementsArrayAttribute): (WebCore::appendAttributes): (WebCore::Element::setAttributeNode): (WebCore::Element::setAttributeNodeNS): (WebCore::Element::setAttributeNS): * Source/WebCore/dom/Element.h: * Source/WebCore/dom/Element.idl: * Source/WebCore/dom/TrustedScript.h: * Source/WebCore/dom/TrustedScriptURL.h: (WebCore::TrustedScriptURL::toString const): Deleted. (WebCore::TrustedScriptURL::toJSON const): Deleted. * Source/WebCore/dom/TrustedType.cpp: (WebCore::stringToTrustedType): (WebCore::trustedTypeForAttribute): * Source/WebCore/dom/TrustedType.h: * Source/WebCore/dom/TrustedTypePolicyFactory.cpp: (WebCore::TrustedTypePolicyFactory::getAttributeType const): * Source/WebKit/WebProcess/InjectedBundle/API/mac/WKDOMElement.mm: (-[WKDOMElement setAttribute:value:]): * Source/WebKitLegacy/mac/DOM/DOMElement.mm: (-[DOMElement setAttribute:value:]): (-[DOMElement setAttributeNS:qualifiedName:value:]):
1 parent 60012b1 commit 04b9b37

20 files changed

Lines changed: 460 additions & 415 deletions

‎LayoutTests/TestExpectations‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5483,13 +5483,14 @@ webkit.org/b/261849 imported/w3c/web-platform-tests/css/css-scroll-anchoring/zer
54835483
webkit.org/b/261849 imported/w3c/web-platform-tests/css/css-scroll-anchoring/start-edge-in-block-layout-direction.html [ Skip ]
54845484

54855485
# Trusted Types aren't fully implemented yet
5486-
webkit.org/b/266630 imported/w3c/web-platform-tests/trusted-types/trusted-types-event-handlers.html [ Skip ]
54875486
webkit.org/b/266630 imported/w3c/web-platform-tests/trusted-types/WorkerGlobalScope-eval.html [ Skip ]
54885487
webkit.org/b/266630 imported/w3c/web-platform-tests/trusted-types/trusted-types-reporting.html [ Skip ]
54895488
webkit.org/b/266630 imported/w3c/web-platform-tests/trusted-types/trusted-types-svg-script.html [ Skip ]
54905489
webkit.org/b/266630 imported/w3c/web-platform-tests/trusted-types/trusted-types-eval-reporting-no-unsafe-eval.html [ Skip ]
54915490
webkit.org/b/266630 imported/w3c/web-platform-tests/trusted-types/trusted-types-eval-reporting-report-only.html [ Skip ]
54925491
webkit.org/b/266630 imported/w3c/web-platform-tests/trusted-types/WorkerGlobalScope-importScripts.html [ Pass Failure ]
5492+
webkit.org/b/266630 imported/w3c/web-platform-tests/trusted-types/trusted-types-navigation.html [ Pass Failure ]
5493+
webkit.org/b/274088 imported/w3c/web-platform-tests/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP.html [ Pass Failure ]
54935494

54945495
# These tests are image failures
54955496
imported/w3c/web-platform-tests/css/css-scroll-anchoring/vertical-rl-viewport-size-change-000.html [ Skip ]

‎LayoutTests/imported/w3c/web-platform-tests/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP-expected.txt‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
1+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
2+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
3+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
4+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
5+
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
6+
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
7+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
8+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
19

210

311

4-
FAIL setAttribute and setAttributeNode respect the element's node document's global's CSP;
5-
Element=iframe; Parent=div; Attribute=srcdoc assert_throws_js: function "() => {
6-
sourceElement.setAttributeNode(sourceAttr);
7-
}" did not throw
8-
FAIL setAttribute and setAttributeNode respect the element's node document's global's CSP;
9-
Element=script; Parent=div; Attribute=src assert_throws_js: function "() => {
10-
sourceElement.setAttributeNode(sourceAttr);
11-
}" did not throw
12-
FAIL setAttribute and setAttributeNode respect the element's node document's global's CSP;
13-
Element=script; Parent=svg; Attribute=href assert_throws_js: function "() => {
14-
sourceElement.setAttributeNode(sourceAttr);
15-
}" did not throw
16-
FAIL setAttribute and setAttributeNode respect the element's node document's global's CSP;
17-
Element=script; Parent=svg; Attribute=xlink:href assert_throws_js: function "() => {
18-
sourceElement.setAttributeNode(sourceAttr);
19-
}" did not throw
12+
PASS setAttribute and setAttributeNode respect the element's node document's global's CSP;
13+
Element=iframe; Parent=div; Attribute=srcdoc
14+
PASS setAttribute and setAttributeNode respect the element's node document's global's CSP;
15+
Element=script; Parent=div; Attribute=src
16+
PASS setAttribute and setAttributeNode respect the element's node document's global's CSP;
17+
Element=script; Parent=svg; Attribute=href
18+
PASS setAttribute and setAttributeNode respect the element's node document's global's CSP;
19+
Element=script; Parent=svg; Attribute=xlink:href
2020

‎LayoutTests/imported/w3c/web-platform-tests/trusted-types/GlobalEventHandlers-onclick-expected.txt‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
1+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
2+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
13

24
PASS a.setAttribte('onclick') sets a trusted script.
3-
FAIL a.setAttribute('onclick') sets an unsuitable trusted type. assert_unreached: Reached unreachable code
4-
FAIL a.setAttribute('click') sets a test string. assert_unreached: Reached unreachable code
5+
PASS a.setAttribute('onclick') sets an unsuitable trusted type.
6+
PASS a.setAttribute('click') sets a test string.
57

‎LayoutTests/imported/w3c/web-platform-tests/trusted-types/TrustedTypePolicyFactory-metadata.tentative-expected.txt‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
2+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
3+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
4+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
5+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
6+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
7+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
8+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
9+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
10+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
11+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
12+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
113

214
PASS Test assignment of string on madeup.madeup
315
PASS Test assignment of string on madeup.setAttribute(madeup,..)
@@ -16,21 +28,21 @@ PASS Test assignment of TrustedScript on madeup.setAttribute(id,..)
1628
PASS Test assignment of TrustedScriptURL on madeup.id
1729
PASS Test assignment of TrustedScriptURL on madeup.setAttribute(id,..)
1830
PASS Test assignment of string on madeup.onerror
19-
FAIL Test assignment of string on madeup.setAttribute(onerror,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
31+
PASS Test assignment of string on madeup.setAttribute(onerror,..)
2032
PASS Test assignment of TrustedHTML on madeup.onerror
21-
FAIL Test assignment of TrustedHTML on madeup.setAttribute(onerror,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
33+
PASS Test assignment of TrustedHTML on madeup.setAttribute(onerror,..)
2234
PASS Test assignment of TrustedScript on madeup.onerror
2335
PASS Test assignment of TrustedScript on madeup.setAttribute(onerror,..)
2436
PASS Test assignment of TrustedScriptURL on madeup.onerror
25-
FAIL Test assignment of TrustedScriptURL on madeup.setAttribute(onerror,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
37+
PASS Test assignment of TrustedScriptURL on madeup.setAttribute(onerror,..)
2638
PASS Test assignment of string on madeup.onclick
27-
FAIL Test assignment of string on madeup.setAttribute(onclick,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
39+
PASS Test assignment of string on madeup.setAttribute(onclick,..)
2840
PASS Test assignment of TrustedHTML on madeup.onclick
29-
FAIL Test assignment of TrustedHTML on madeup.setAttribute(onclick,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
41+
PASS Test assignment of TrustedHTML on madeup.setAttribute(onclick,..)
3042
PASS Test assignment of TrustedScript on madeup.onclick
3143
PASS Test assignment of TrustedScript on madeup.setAttribute(onclick,..)
3244
PASS Test assignment of TrustedScriptURL on madeup.onclick
33-
FAIL Test assignment of TrustedScriptURL on madeup.setAttribute(onclick,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
45+
PASS Test assignment of TrustedScriptURL on madeup.setAttribute(onclick,..)
3446
PASS Test assignment of string on b.madeup
3547
PASS Test assignment of string on b.setAttribute(madeup,..)
3648
PASS Test assignment of TrustedHTML on b.madeup
@@ -48,19 +60,19 @@ PASS Test assignment of TrustedScript on b.setAttribute(id,..)
4860
PASS Test assignment of TrustedScriptURL on b.id
4961
PASS Test assignment of TrustedScriptURL on b.setAttribute(id,..)
5062
PASS Test assignment of string on b.onerror
51-
FAIL Test assignment of string on b.setAttribute(onerror,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
63+
PASS Test assignment of string on b.setAttribute(onerror,..)
5264
PASS Test assignment of TrustedHTML on b.onerror
53-
FAIL Test assignment of TrustedHTML on b.setAttribute(onerror,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
65+
PASS Test assignment of TrustedHTML on b.setAttribute(onerror,..)
5466
PASS Test assignment of TrustedScript on b.onerror
5567
PASS Test assignment of TrustedScript on b.setAttribute(onerror,..)
5668
PASS Test assignment of TrustedScriptURL on b.onerror
57-
FAIL Test assignment of TrustedScriptURL on b.setAttribute(onerror,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
69+
PASS Test assignment of TrustedScriptURL on b.setAttribute(onerror,..)
5870
PASS Test assignment of string on b.onclick
59-
FAIL Test assignment of string on b.setAttribute(onclick,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
71+
PASS Test assignment of string on b.setAttribute(onclick,..)
6072
PASS Test assignment of TrustedHTML on b.onclick
61-
FAIL Test assignment of TrustedHTML on b.setAttribute(onclick,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
73+
PASS Test assignment of TrustedHTML on b.setAttribute(onclick,..)
6274
PASS Test assignment of TrustedScript on b.onclick
6375
PASS Test assignment of TrustedScript on b.setAttribute(onclick,..)
6476
PASS Test assignment of TrustedScriptURL on b.onclick
65-
FAIL Test assignment of TrustedScriptURL on b.setAttribute(onclick,..) assert_throws_js: throws function "_ => { element.setAttribute(property, value); }" did not throw
77+
PASS Test assignment of TrustedScriptURL on b.setAttribute(onclick,..)
6678

‎LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setAttribute-expected.txt‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,24 @@
1+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
2+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
3+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
4+
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
5+
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
6+
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
7+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
8+
CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
9+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
110

2-
FAIL script.src accepts only TrustedScriptURL assert_throws_js: function "_ => {
3-
elem.setAttribute(attribute, value);
4-
}" did not throw
5-
FAIL iframe.srcdoc accepts only TrustedHTML assert_throws_js: function "_ => {
6-
elem.setAttribute(attribute, value);
7-
}" did not throw
8-
FAIL div.onclick accepts only TrustedScript assert_throws_js: function "_ => {
9-
elem.setAttribute(attribute, value);
10-
}" did not throw
11-
FAIL `Script.prototype.setAttribute.SrC = string` throws. assert_throws_js: function "_ => {
12-
el.setAttribute('SrC', INPUTS.URL);
13-
}" did not throw
11+
PASS script.src accepts only TrustedScriptURL
12+
PASS iframe.srcdoc accepts only TrustedHTML
13+
PASS div.onclick accepts only TrustedScript
14+
PASS `Script.prototype.setAttribute.SrC = string` throws.
1415
PASS script.src accepts string and null after default policy was created.
15-
FAIL script.src's mutationobservers receive the default policy's value. assert_equals: expected "http://this.is.a.successful.test/" but got "http://this.is.a.scripturl.test/"
16-
FAIL iframe.srcdoc's mutationobservers receive the default policy's value. assert_equals: expected "Quack, I want to be a duck!" but got "Hi, I want to be transformed!"
17-
FAIL div.onclick's mutationobservers receive the default policy's value. assert_equals: expected "Meow, I want to be a cat!" but got "Hi, I want to be transformed!"
16+
PASS script.src's mutationobservers receive the default policy's value.
17+
PASS iframe.srcdoc's mutationobservers receive the default policy's value.
18+
PASS div.onclick's mutationobservers receive the default policy's value.
1819
PASS iframe.srcdoc accepts string and null after default policy was created.
19-
FAIL div.onclick accepts string and null after default policy was created. assert_equals: expected "Meow, I want to be a cat!" but got "Hi, I want to be transformed!"
20+
PASS div.onclick accepts string and null after default policy was created.
2021
PASS a.rel accepts strings
2122
PASS a.rel accepts null
22-
FAIL `script.src = setAttributeNode(embed.src)` with string works. assert_equals: expected "http://this.is.a.successful.test/" but got "http://this.is.a.scripturl.test/"
23+
PASS `script.src = setAttributeNode(embed.src)` with string works.
2324

‎LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setAttributeNS-expected.txt‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
1+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
2+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
3+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
4+
CONSOLE MESSAGE: This requires a TrustedScriptURL value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
15

26
PASS Element.setAttributeNS assigned via policy (successful HTML transformation)
37
PASS Element.setAttributeNS assigned via policy (successful Script transformation)
48
PASS Element.setAttributeNS assigned via policy (successful ScriptURL transformation)
59
PASS Element.setAttributeNS accepts untrusted string for non-specced accessor
610
PASS Element.setAttributeNS accepts null for non-specced accessor
711
PASS Assigning TrustedScriptURL to <svg:script xlink:href=...> works
8-
FAIL Blocking non-TrustedScriptURL assignment to <svg:script xlink:href=...> works assert_throws_js: function "_ => {
9-
elem.setAttributeNS(xlinkNamespace, "href", v);
10-
}" did not throw
12+
PASS Blocking non-TrustedScriptURL assignment to <svg:script xlink:href=...> works
1113
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "SRCDOC" (ns=null) for "iframe" element (ns=http://www.w3.org/1999/xhtml).
1214
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "SRC" (ns=null) for "script" element (ns=http://www.w3.org/1999/xhtml).
1315
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "HREF" (ns=null) for "script" element (ns=http://www.w3.org/2000/svg).

0 commit comments

Comments
 (0)