Trusted types attributes #1268

lukewarlow · 2024-03-27T19:22:16Z

This calls the get Trusted Types-compliant attribute value algorithm from Trusted Types (w3c/trusted-types#418) from attribute's change, append, and replace.

Changed the signature of setAttribute and setAttributeNS to accept Trusted Types as values. The underlying Attr node's values continue to be DOMString, so moving nodes across elements or adding standalone attributes to elements can cause TT violations. This matches WPT tests and the Chromium's implementation.

See and #789. Supercedes #809 and #1247

At least two implementers are interested (and none opposed):
- Chromium
- Gecko
Tests are written and can be reviewed and commented upon at:
- https://github.com/web-platform-tests/wpt/tree/master/trusted-types
Implementation bugs are filed:
- Chromium:https://bugs.chromium.org/p/chromium/issues/detail?id=739170
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1508286
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=266630
MDN issue is filed: …
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

Preview | Diff

lukewarlow · 2024-03-27T19:22:41Z

This is a clone of #1247 where I will finish any outstanding work to get this across the line

lukewarlow · 2024-04-11T12:21:53Z

See also #1258 which is another integration point with the DOM spec that we need for TT.

dom.bs

otherdaniel · 2024-04-15T17:13:57Z

dom.bs

+   <li><p><a>Validate and set attribute value</a> <var>attr</var>'s <a for="Attr">value</a> for
+   <var>attr</var> with <var>element</var>.
+
+   <li><p>If <var>element</var> <a lt="has an attribute">has</a> an <a>attribute</a>


I still find it difficult to wrap my head around this logic. I think conceptually, we want to have the old value -- from before the call, and thus before a default policy might have mucked with it. That's what should go into the change attribute logic. But once we have that, I'm not sure why we'd need to throw an exception here. I'm not sure why we'd have to care whether the default policy does anything funny with the attribute in the mean time.

I've read through this spec path and I believe that, if the default policy removes the existing attribute node, then this will call replace an attribute, which in turn calls replace a list item, which results in a no-op because the old value no longer exists to be replaced.

So I think in this situation you're probably right the spec doesn't need to do anything, will make that change.

Having said that I'm slightly uneasy about stuff like attribute change steps still firing and how that all works spec wise.

Both Chromium and WebKit don't actually follow the spec 100% here and so I think would actually result in a different behaviour to this spec (the index lookup happens after the TT call) so that's also not ideal.

lukewarlow · 2024-04-22T13:18:23Z

I think I've addressed all the comments from #1247.

I do want to point out Chrome and WebKit don't (or at least not in a way obvious to me) 100% follow the flow of the spec and as a result this may result in differences specifically in weird cases with attribute mutation.

So that bit especially it would be good to get feedback on.

It's also worth being aware that like Chromium's implementation this spec means that certain ways to update a nodes value don't work with a trusted type object as a user might expect. (e.g. iframe.getAttributeNode('srcdoc').value = trustedHTMLObj; will throw unless allowed by a default policy). I think in pratice this will be fine, and in some cases is the only real option we have without nodes keeping track of whether they're trusted or not (which would add lots of complexity)

annevk

This change is either incomplete or makes many cosmetic changes that would be best proposed separately as they confuse me quite a bit.

dom.bs

lukewarlow · 2024-04-22T15:47:56Z

This change is either incomplete or makes many cosmetic changes that would be best proposed separately as they confuse me quite a bit.

Apologies I thought I'd reverted all of these changes but I missed a few, it's because I changed stuff and then changed it back and this led to some wonky diffs. Have hopefully reverted all of these unnecessary changes

annevk · 2024-04-22T16:07:37Z

dom.bs

+ <li><p>If <var>attribute</var>'s <a for=Attr>element</a> <a lt="has an attribute">has</a>
+ an <a>attribute</a> <var>attribute</var>, then <a>handle attribute changes</a> for
+ <var>attribute</var> with <var>attribute</var>'s <a for=Attr>element</a>, <var>oldValue</var>, and
+ <var>value</var>.


Should this be value or attribute's value? They can be different, right?

dom.bs

lukewarlow · 2024-05-07T15:54:52Z

@otherdaniel, @annevk , and @smaug---- regarding the case where the default policy changes assumptions about the existence of an attribute mid-way through what would you prefer the spec say to do? Currently I've specced to throw, but Chromium currently re-looks up the index (spec doesn't explicitly work on an index basis but Chromium and WebKit do)

annevk · 2024-05-13T14:58:26Z

Attributes are stored in a list and those do have indices per Infra. What am I missing?

lukewarlow · 2024-05-13T15:03:24Z

Sorry I mean algorithmically the spec and implementations don't follow the same flow. So it's trickier to reason between the spec and implementation. This might just be my lack of familiarity with these APIs too.

annevk · 2024-05-13T15:11:38Z

The path of least resistance is prolly matching Chromium. Introducing new paths that throw is always risky. If you are looking for guidance as to how, I'd need quite a bit more context to provide helpful suggestions.

…ibuteNS. r=smaug See whatwg/dom#1268 https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute Differential Revision: https://phabricator.services.mozilla.com/D227943

…ibuteNS. r=smaug See whatwg/dom#1268 https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute Differential Revision: https://phabricator.services.mozilla.com/D227943 UltraBlame original commit: db598441827d9d6b96eaf6105be7e9a3329bc722

…ibuteNS. r=smaug See whatwg/dom#1268 https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute Differential Revision: https://phabricator.services.mozilla.com/D227943 UltraBlame original commit: eb723beab1df058d28341911456022a9f41c9bab

…ibuteNS. r=smaug See whatwg/dom#1268 https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute Differential Revision: https://phabricator.services.mozilla.com/D227943 UltraBlame original commit: db598441827d9d6b96eaf6105be7e9a3329bc722

…ibuteNS. r=smaug See whatwg/dom#1268 https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute Differential Revision: https://phabricator.services.mozilla.com/D227943 UltraBlame original commit: eb723beab1df058d28341911456022a9f41c9bab

…ibuteNS. r=smaug See whatwg/dom#1268 https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute Differential Revision: https://phabricator.services.mozilla.com/D227943 UltraBlame original commit: db598441827d9d6b96eaf6105be7e9a3329bc722

…ibuteNS. r=smaug See whatwg/dom#1268 https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute Differential Revision: https://phabricator.services.mozilla.com/D227943 UltraBlame original commit: eb723beab1df058d28341911456022a9f41c9bab

This test is intended to cover setting href [1] [2] but it also currently verifies some (currently not specified) unrelated behavior when setting the text of the script via innerHTML. A similar test exist in block-text-node-insertion-into-svg-script-element.html, but for a disconnected script. This PR just move the unrelated test to trusted-types-svg-script.html instead. [1] w3c/svgwg#934 [2] whatwg/dom#1268

…butes This is a tentative test for [1] covering bullet 3 from [2]. There is a separate PR to cover the bullet 2 [3]. Most of these are probably already covered by other tests but assertions are scattered into multiple files as a side check in the default policy callback, so they are hard to understand and to guarantee they actually run (some mistakes were previously found about this in the past). Additionnaly, this new test cover both setAttribute and setAttributeNS and ensure the correct callback is called exactly once with proper attributes (e.g. to verify a call to setAttribute does not trigger the callback with the parameters of a reflected IDL attribute). [1] whatwg/dom#1268 [2] https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute [3] #50025

…butes (#50046) This is a tentative test for [1] covering bullet 3 from [2]. There is a separate PR to cover the bullet 2 [3]. Most of these are probably already covered by other tests but assertions are scattered into multiple files as a side check in the default policy callback, so they are hard to understand and to guarantee they actually run (some mistakes were previously found about this in the past). Additionally, this new test cover both setAttribute and setAttributeNS and ensure the correct callback is called exactly once with proper attributes (e.g. to verify a call to setAttribute does not trigger the callback with the parameters of a reflected IDL attribute). [1] whatwg/dom#1268 [2] https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute [3] #50025

…50043) * Remove unrelated checks from trusted-types-svg-script-set-href.html This test is intended to cover setting href [1] [2] but it also currently verifies some (currently not specified) unrelated behavior when setting the text of the script via innerHTML. A similar test exist in block-text-node-insertion-into-svg-script-element.html, but for a disconnected script. This PR just move the unrelated test to trusted-types-svg-script.html instead. [1] w3c/svgwg#934 [2] whatwg/dom#1268

…butes (#50046) This is a tentative test for [1] covering bullet 3 from [2]. There is a separate PR to cover the bullet 2 [3]. Most of these are probably already covered by other tests but assertions are scattered into multiple files as a side check in the default policy callback, so they are hard to understand and to guarantee they actually run (some mistakes were previously found about this in the past). Additionally, this new test cover both setAttribute and setAttributeNS and ensure the correct callback is called exactly once with proper attributes (e.g. to verify a call to setAttribute does not trigger the callback with the parameters of a reflected IDL attribute). [1] whatwg/dom#1268 [2] https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute [3] #50025

…50043) * Remove unrelated checks from trusted-types-svg-script-set-href.html This test is intended to cover setting href [1] [2] but it also currently verifies some (currently not specified) unrelated behavior when setting the text of the script via innerHTML. A similar test exist in block-text-node-insertion-into-svg-script-element.html, but for a disconnected script. This PR just move the unrelated test to trusted-types-svg-script.html instead. [1] w3c/svgwg#934 [2] whatwg/dom#1268

…S and non-event-handler attri…, a=testonly Automatic update from web-platform-tests Add tests for setAttribute/setAttributeNS and non-event-handler attributes (#50046) This is a tentative test for [1] covering bullet 3 from [2]. There is a separate PR to cover the bullet 2 [3]. Most of these are probably already covered by other tests but assertions are scattered into multiple files as a side check in the default policy callback, so they are hard to understand and to guarantee they actually run (some mistakes were previously found about this in the past). Additionally, this new test cover both setAttribute and setAttributeNS and ensure the correct callback is called exactly once with proper attributes (e.g. to verify a call to setAttribute does not trigger the callback with the parameters of a reflected IDL attribute). [1] whatwg/dom#1268 [2] https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute [3] web-platform-tests/wpt#50025 -- wpt-commits: 35de05425036bf714b270c76dd00892900002963 wpt-pr: 50046

…es-svg-script-set-href.html, a=testonly Automatic update from web-platform-tests Remove unrelated checks from trusted-types-svg-script-set-href.html (#50043) * Remove unrelated checks from trusted-types-svg-script-set-href.html This test is intended to cover setting href [1] [2] but it also currently verifies some (currently not specified) unrelated behavior when setting the text of the script via innerHTML. A similar test exist in block-text-node-insertion-into-svg-script-element.html, but for a disconnected script. This PR just move the unrelated test to trusted-types-svg-script.html instead. [1] w3c/svgwg#934 [2] whatwg/dom#1268 -- wpt-commits: 696792b6aa714c2d7c54b986814bbdbbdecf1dd8 wpt-pr: 50043

…S and non-event-handler attri…, a=testonly Automatic update from web-platform-tests Add tests for setAttribute/setAttributeNS and non-event-handler attributes (#50046) This is a tentative test for [1] covering bullet 3 from [2]. There is a separate PR to cover the bullet 2 [3]. Most of these are probably already covered by other tests but assertions are scattered into multiple files as a side check in the default policy callback, so they are hard to understand and to guarantee they actually run (some mistakes were previously found about this in the past). Additionally, this new test cover both setAttribute and setAttributeNS and ensure the correct callback is called exactly once with proper attributes (e.g. to verify a call to setAttribute does not trigger the callback with the parameters of a reflected IDL attribute). [1] whatwg/dom#1268 [2] https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute [3] web-platform-tests/wpt#50025 -- wpt-commits: 35de05425036bf714b270c76dd00892900002963 wpt-pr: 50046 UltraBlame original commit: 4846e5ab139c44c223566809053c5948cd2d8d16

…es-svg-script-set-href.html, a=testonly Automatic update from web-platform-tests Remove unrelated checks from trusted-types-svg-script-set-href.html (#50043) * Remove unrelated checks from trusted-types-svg-script-set-href.html This test is intended to cover setting href [1] [2] but it also currently verifies some (currently not specified) unrelated behavior when setting the text of the script via innerHTML. A similar test exist in block-text-node-insertion-into-svg-script-element.html, but for a disconnected script. This PR just move the unrelated test to trusted-types-svg-script.html instead. [1] w3c/svgwg#934 [2] whatwg/dom#1268 -- wpt-commits: 696792b6aa714c2d7c54b986814bbdbbdecf1dd8 wpt-pr: 50043 UltraBlame original commit: c08a3d36866a0421ce1e7f511543715b7a9c1b38

…S and non-event-handler attri…, a=testonly Automatic update from web-platform-tests Add tests for setAttribute/setAttributeNS and non-event-handler attributes (#50046) This is a tentative test for [1] covering bullet 3 from [2]. There is a separate PR to cover the bullet 2 [3]. Most of these are probably already covered by other tests but assertions are scattered into multiple files as a side check in the default policy callback, so they are hard to understand and to guarantee they actually run (some mistakes were previously found about this in the past). Additionally, this new test cover both setAttribute and setAttributeNS and ensure the correct callback is called exactly once with proper attributes (e.g. to verify a call to setAttribute does not trigger the callback with the parameters of a reflected IDL attribute). [1] whatwg/dom#1268 [2] https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute [3] web-platform-tests/wpt#50025 -- wpt-commits: 35de05425036bf714b270c76dd00892900002963 wpt-pr: 50046 UltraBlame original commit: 4846e5ab139c44c223566809053c5948cd2d8d16

…es-svg-script-set-href.html, a=testonly Automatic update from web-platform-tests Remove unrelated checks from trusted-types-svg-script-set-href.html (#50043) * Remove unrelated checks from trusted-types-svg-script-set-href.html This test is intended to cover setting href [1] [2] but it also currently verifies some (currently not specified) unrelated behavior when setting the text of the script via innerHTML. A similar test exist in block-text-node-insertion-into-svg-script-element.html, but for a disconnected script. This PR just move the unrelated test to trusted-types-svg-script.html instead. [1] w3c/svgwg#934 [2] whatwg/dom#1268 -- wpt-commits: 696792b6aa714c2d7c54b986814bbdbbdecf1dd8 wpt-pr: 50043 UltraBlame original commit: c08a3d36866a0421ce1e7f511543715b7a9c1b38

…S and non-event-handler attri…, a=testonly Automatic update from web-platform-tests Add tests for setAttribute/setAttributeNS and non-event-handler attributes (#50046) This is a tentative test for [1] covering bullet 3 from [2]. There is a separate PR to cover the bullet 2 [3]. Most of these are probably already covered by other tests but assertions are scattered into multiple files as a side check in the default policy callback, so they are hard to understand and to guarantee they actually run (some mistakes were previously found about this in the past). Additionally, this new test cover both setAttribute and setAttributeNS and ensure the correct callback is called exactly once with proper attributes (e.g. to verify a call to setAttribute does not trigger the callback with the parameters of a reflected IDL attribute). [1] whatwg/dom#1268 [2] https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute [3] web-platform-tests/wpt#50025 -- wpt-commits: 35de05425036bf714b270c76dd00892900002963 wpt-pr: 50046 UltraBlame original commit: 4846e5ab139c44c223566809053c5948cd2d8d16

…es-svg-script-set-href.html, a=testonly Automatic update from web-platform-tests Remove unrelated checks from trusted-types-svg-script-set-href.html (#50043) * Remove unrelated checks from trusted-types-svg-script-set-href.html This test is intended to cover setting href [1] [2] but it also currently verifies some (currently not specified) unrelated behavior when setting the text of the script via innerHTML. A similar test exist in block-text-node-insertion-into-svg-script-element.html, but for a disconnected script. This PR just move the unrelated test to trusted-types-svg-script.html instead. [1] w3c/svgwg#934 [2] whatwg/dom#1268 -- wpt-commits: 696792b6aa714c2d7c54b986814bbdbbdecf1dd8 wpt-pr: 50043 UltraBlame original commit: c08a3d36866a0421ce1e7f511543715b7a9c1b38

…S and non-event-handler attri…, a=testonly Automatic update from web-platform-tests Add tests for setAttribute/setAttributeNS and non-event-handler attributes (#50046) This is a tentative test for [1] covering bullet 3 from [2]. There is a separate PR to cover the bullet 2 [3]. Most of these are probably already covered by other tests but assertions are scattered into multiple files as a side check in the default policy callback, so they are hard to understand and to guarantee they actually run (some mistakes were previously found about this in the past). Additionally, this new test cover both setAttribute and setAttributeNS and ensure the correct callback is called exactly once with proper attributes (e.g. to verify a call to setAttribute does not trigger the callback with the parameters of a reflected IDL attribute). [1] whatwg/dom#1268 [2] https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute [3] web-platform-tests/wpt#50025 -- wpt-commits: 35de05425036bf714b270c76dd00892900002963 wpt-pr: 50046

…es-svg-script-set-href.html, a=testonly Automatic update from web-platform-tests Remove unrelated checks from trusted-types-svg-script-set-href.html (#50043) * Remove unrelated checks from trusted-types-svg-script-set-href.html This test is intended to cover setting href [1] [2] but it also currently verifies some (currently not specified) unrelated behavior when setting the text of the script via innerHTML. A similar test exist in block-text-node-insertion-into-svg-script-element.html, but for a disconnected script. This PR just move the unrelated test to trusted-types-svg-script.html instead. [1] w3c/svgwg#934 [2] whatwg/dom#1268 -- wpt-commits: 696792b6aa714c2d7c54b986814bbdbbdecf1dd8 wpt-pr: 50043

lukewarlow force-pushed the trusted-types-attributes branch 2 times, most recently from 3562fcb to ac5b4aa Compare April 10, 2024 15:52

lukewarlow mentioned this pull request Apr 11, 2024

Draft integration with Trusted Types, take 2. #1247

Closed

5 tasks

lukewarlow force-pushed the trusted-types-attributes branch from 524d8cd to f8877b6 Compare April 11, 2024 12:18

lukewarlow marked this pull request as ready for review April 11, 2024 12:21

lukewarlow marked this pull request as draft April 15, 2024 10:22

lukewarlow force-pushed the trusted-types-attributes branch from f8877b6 to ee9915e Compare April 15, 2024 11:45

otherdaniel reviewed Apr 15, 2024

View reviewed changes

dom.bs Outdated Show resolved Hide resolved

otherdaniel reviewed Apr 15, 2024

View reviewed changes

lukewarlow marked this pull request as ready for review April 22, 2024 12:53

lukewarlow requested review from annevk and smaug---- April 22, 2024 13:13

lukewarlow force-pushed the trusted-types-attributes branch from ba80870 to 36476b5 Compare April 22, 2024 13:57

lukewarlow mentioned this pull request Apr 22, 2024

[Meta] Upstream changes w3c/trusted-types#476

Open

annevk reviewed Apr 22, 2024

View reviewed changes

dom.bs Outdated Show resolved Hide resolved

dom.bs Outdated Show resolved Hide resolved

dom.bs Outdated Show resolved Hide resolved

dom.bs Outdated Show resolved Hide resolved

dom.bs Outdated Show resolved Hide resolved

lukewarlow force-pushed the trusted-types-attributes branch from 370f5c9 to 4421d50 Compare April 22, 2024 15:46

lukewarlow force-pushed the trusted-types-attributes branch 2 times, most recently from 1d42460 to 1eeaf00 Compare April 22, 2024 15:52

annevk reviewed Apr 22, 2024

View reviewed changes

lukewarlow force-pushed the trusted-types-attributes branch 2 times, most recently from 4089eaf to 02db8c7 Compare May 16, 2024 15:41

lukewarlow requested a review from otherdaniel May 16, 2024 15:43

mbrodesser-Igalia mentioned this pull request Dec 11, 2024

Test TT is not enforced when taking an element out of a TT realm to a… web-platform-tests/wpt#46432

Closed

This was referenced Jan 3, 2025

Improve test coverage of sink values w3c/trusted-types#494

Closed

Examine tests which are commented out in <GlobalEventHandlers-onclick.html> w3c/trusted-types#571

Closed

fred-wang mentioned this pull request Jan 13, 2025

Remove unrelated checks from trusted-types-svg-script-set-href.html web-platform-tests/wpt#50043

Merged

fred-wang mentioned this pull request Jan 13, 2025

Add tests for setAttribute/setAttributeNS and non-event-handler attri… web-platform-tests/wpt#50046

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Trusted types attributes #1268

Trusted types attributes #1268

lukewarlow commented Mar 27, 2024 •

edited by pr-preview bot

Loading

lukewarlow commented Mar 27, 2024

lukewarlow commented Apr 11, 2024

otherdaniel Apr 15, 2024

lukewarlow Apr 22, 2024

lukewarlow Apr 22, 2024

lukewarlow commented Apr 22, 2024

annevk left a comment

lukewarlow commented Apr 22, 2024

annevk Apr 22, 2024

lukewarlow commented May 7, 2024 •

edited

Loading

annevk commented May 13, 2024

lukewarlow commented May 13, 2024

annevk commented May 13, 2024

Trusted types attributes #1268

Are you sure you want to change the base?

Trusted types attributes #1268

Conversation

lukewarlow commented Mar 27, 2024 • edited by pr-preview bot Loading

lukewarlow commented Mar 27, 2024

lukewarlow commented Apr 11, 2024

otherdaniel Apr 15, 2024

Choose a reason for hiding this comment

lukewarlow Apr 22, 2024

Choose a reason for hiding this comment

lukewarlow Apr 22, 2024

Choose a reason for hiding this comment

lukewarlow commented Apr 22, 2024

annevk left a comment

Choose a reason for hiding this comment

lukewarlow commented Apr 22, 2024

annevk Apr 22, 2024

Choose a reason for hiding this comment

lukewarlow commented May 7, 2024 • edited Loading

annevk commented May 13, 2024

lukewarlow commented May 13, 2024

annevk commented May 13, 2024

lukewarlow commented Mar 27, 2024 •

edited by pr-preview bot

Loading

lukewarlow commented May 7, 2024 •

edited

Loading