Change Script Enforcement Mechanism to use flags by lukewarlow · Pull Request #579 · w3c/trusted-types

lukewarlow · 2025-02-03T15:27:33Z

Also add SVGScriptElement to spec

lukewarlow · 2025-02-03T15:32:15Z

This still requires changes to deal with the issues related to children changed steps being fired by parser.

Also add SVGScriptElement to spec

lukewarlow · 2025-02-03T15:48:12Z

spec/index.bs

+
+1.  Set [=this=]'s [=SVGScriptElement/is trusted=] to false.
+
+1.  Run the {{SVGScriptElement|script}} [=post-connection steps=], given [=this=].


Does SVG even have this?

SVG has very little but we can add a note that we assume it has the same as HTML script has.

lukewarlow · 2025-02-25T15:31:16Z

Opened #581 to at least add SVG to the existing spec while this bit is still to be worked out.

fred-wang · 2025-05-16T12:00:38Z

spec/index.bs

  <li>...
  </ol>

+Issue: There's no proper definition for the processing of SVG script elements. However, you should apply a similar change to the processing of {{SVGScriptElement}}s.


Can we mention the sink name explicitly? WebKit uses "SVGScriptElement text": https://searchfox.org/wubkat/rev/d1661224f525bf15e34fde4eafe9de09b92c864b/Source/WebCore/dom/ScriptElement.cpp#192

… text transformed by the default policy. r=smaug This verifies that the source text transformed by the default policy is used for various steps of "prepare the script element": https://html.spec.whatwg.org/#prepare-the-script-element PR w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D251456

…ormed by the default policy. This verifies that the source text transformed by the default policy is used for various steps of "prepare the script element": https://html.spec.whatwg.org/#prepare-the-script-element PR w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D251456 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1968383 gecko-commit: b40ba3e6cd668c9890ed7e4c6bdfdf2ee60cbcc4 gecko-reviewers: smaug

… text transformed by the default policy. r=smaug This verifies that the source text transformed by the default policy is used for various steps of "prepare the script element": https://html.spec.whatwg.org/#prepare-the-script-element PR w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D251456

… text transformed by the default policy. r=smaug This verifies that the source text transformed by the default policy is used for various steps of "prepare the script element": https://html.spec.whatwg.org/#prepare-the-script-element PR w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D251456 UltraBlame original commit: b40ba3e6cd668c9890ed7e4c6bdfdf2ee60cbcc4

…ormed by the default policy. This verifies that the source text transformed by the default policy is used for various steps of "prepare the script element": https://html.spec.whatwg.org/#prepare-the-script-element PR w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D251456 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1968383 gecko-commit: b40ba3e6cd668c9890ed7e4c6bdfdf2ee60cbcc4 gecko-reviewers: smaug

…maug,credential-management-reviewers,dimi This flag can be modified when notifying for character data change, content appending, content insertion and content removal by specifying a MutationEffectOnScript flag. By default callers other than the HTML5 parsers always specify "drop trustworthiness" but mIsTrusted flag is not used anyway, so there is no behavior change. Spec: https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts PR: w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D252020

…maug,credential-management-reviewers,dimi This flag can be modified when notifying for character data change, content appending, content insertion and content removal by specifying a MutationEffectOnScript flag. By default callers other than the HTML5 parsers always specify "drop trustworthiness" but mIsTrusted flag is not used anyway, so there is no behavior change. Spec: https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts PR: w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D252020 UltraBlame original commit: 8f6d960e567bd265b1d2478c7ad6868b6872cd22

…maug,credential-management-reviewers,dimi This flag can be modified when notifying for character data change, content appending, content insertion and content removal by specifying a MutationEffectOnScript flag. By default callers other than the HTML5 parsers always specify "drop trustworthiness" but mIsTrusted flag is not used anyway, so there is no behavior change. Spec: https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts PR: w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D252020 UltraBlame original commit: bb51e4ab08008c6f6920e651994b59de56d19383

…maug,credential-management-reviewers,dimi This flag can be modified when notifying for character data change, content appending, content insertion and content removal by specifying a MutationEffectOnScript flag. By default callers other than the HTML5 parsers always specify "drop trustworthiness" but mIsTrusted flag is not used anyway, so there is no behavior change. Spec: https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts PR: w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D252020 UltraBlame original commit: 8f6d960e567bd265b1d2478c7ad6868b6872cd22

…maug,credential-management-reviewers,dimi This flag can be modified when notifying for character data change, content appending, content insertion and content removal by specifying a MutationEffectOnScript flag. By default callers other than the HTML5 parsers always specify "drop trustworthiness" but mIsTrusted flag is not used anyway, so there is no behavior change. Spec: https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts PR: w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D252020 UltraBlame original commit: bb51e4ab08008c6f6920e651994b59de56d19383

…maug,credential-management-reviewers,dimi This flag can be modified when notifying for character data change, content appending, content insertion and content removal by specifying a MutationEffectOnScript flag. By default callers other than the HTML5 parsers always specify "drop trustworthiness" but mIsTrusted flag is not used anyway, so there is no behavior change. Spec: https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts PR: w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D252020 UltraBlame original commit: 8f6d960e567bd265b1d2478c7ad6868b6872cd22

…maug,credential-management-reviewers,dimi This flag can be modified when notifying for character data change, content appending, content insertion and content removal by specifying a MutationEffectOnScript flag. By default callers other than the HTML5 parsers always specify "drop trustworthiness" but mIsTrusted flag is not used anyway, so there is no behavior change. Spec: https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts PR: w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D252020 UltraBlame original commit: bb51e4ab08008c6f6920e651994b59de56d19383

…ements. r=smaug Spec: https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts PR: w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D251855

…ements. r=smaug Spec: https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts PR: w3c/trusted-types#579 Differential Revision: https://phabricator.services.mozilla.com/D251855 UltraBlame original commit: bec0b586fa9e173e14dbf710ba6c232df7067451

… before require-trusted-types-for 'script' is set. Current spec [1] essentially caches the "script text" associated to a script element: it is initially empty and updated by various APIs calls. The "prepare the script element" algorithm is modified [2], so that "child text content" would go through the default policy if it does not match the cached "script text" [3]. Script enforcement could be alternatively be implemented by flags [4]. In that case, it might be tempting not to update the flags when the API calls modifying a script are performed before Trusted Types are actually enforced, with the rationale that these API calls are not considered untrusted at that time. For a cache-based implementations, this would be equivalent to not caching the "script text" until the first time it is set in a context when Trusted Types is enforced. However, WebKit and Chromium follow the spec and really try and run the default policy on the script text, even if the script text was modified before TrustedTypes enforcement got enabled. This PR adds a test to verify this behavior for HTML and SVG scripts. [1] https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts [2] https://w3c.github.io/trusted-types/dist/spec/#slot-value-verification [3] https://w3c.github.io/trusted-types/dist/spec/#prepare-the-script-text [4] w3c/trusted-types#579

… before require-trusted-types-for 'script' is set. Current spec [1] essentially caches the "script text" associated to a script element: it is initially empty and updated by various APIs calls. The "prepare the script element" algorithm is modified [2], so that "child text content" would go through the default policy if it does not match the cached "script text" [3]. Script enforcement could be alternatively be implemented by flags [4]. In that case, it might be tempting not to update the flags when the API calls modifying a script are performed before Trusted Types are actually enforced, with the rationale that these API calls are not considered untrusted at that time. For a cache-based implementations, this would be equivalent to not caching the "script text" until the first time it is set in a context when Trusted Types is enforced. However, WebKit and Chromium follow the spec and really try and run the default policy on the script text, even if the script text was modified before TrustedTypes enforcement got enabled. This PR adds tests to verify this behavior for HTML and SVG scripts. For completeness, this also verifies that if we remove the require-trusted-types-for meta tag before the test is executed, then TrustedTypes enforcement remains enabled per [5]. [1] https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts [2] https://w3c.github.io/trusted-types/dist/spec/#slot-value-verification [3] https://w3c.github.io/trusted-types/dist/spec/#prepare-the-script-text [4] w3c/trusted-types#579 [5] https://www.w3.org/TR/CSP3/#meta-element

…f the source text is modified before require-trusted-types-for 'script' is set., a=testonly Automatic update from web-platform-tests Verify script enforcement applies even if the source text is modified before require-trusted-types-for 'script' is set. Current spec [1] essentially caches the "script text" associated to a script element: it is initially empty and updated by various APIs calls. The "prepare the script element" algorithm is modified [2], so that "child text content" would go through the default policy if it does not match the cached "script text" [3]. Script enforcement could be alternatively be implemented by flags [4]. In that case, it might be tempting not to update the flags when the API calls modifying a script are performed before Trusted Types are actually enforced, with the rationale that these API calls are not considered untrusted at that time. For a cache-based implementations, this would be equivalent to not caching the "script text" until the first time it is set in a context when Trusted Types is enforced. However, WebKit and Chromium follow the spec and really try and run the default policy on the script text, even if the script text was modified before TrustedTypes enforcement got enabled. This PR adds tests to verify this behavior for HTML and SVG scripts. For completeness, this also verifies that if we remove the require-trusted-types-for meta tag before the test is executed, then TrustedTypes enforcement remains enabled per [5]. [1] https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts [2] https://w3c.github.io/trusted-types/dist/spec/#slot-value-verification [3] https://w3c.github.io/trusted-types/dist/spec/#prepare-the-script-text [4] w3c/trusted-types#579 [5] https://www.w3.org/TR/CSP3/#meta-element -- wpt-commits: 6981356e8191be363fac96b43cdecc92f145e85e wpt-pr: 56548

Change Script Enforcement Mechanism to use flags

11456d2

Also add SVGScriptElement to spec

lukewarlow force-pushed the script-protection-v3 branch from 05fda45 to 11456d2 Compare February 3, 2025 15:47

lukewarlow commented Feb 3, 2025

View reviewed changes

fred-wang reviewed May 16, 2025

View reviewed changes

fred-wang mentioned this pull request Dec 6, 2025

Verify script enforcement applies even if the source text is modified before require-trusted-types-for 'script' is set. web-platform-tests/wpt#56548

Merged

fred-wang mentioned this pull request Jan 27, 2026

TrustedTypes: Indirect sinks mdn/content#42638

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Change Script Enforcement Mechanism to use flags#579

Change Script Enforcement Mechanism to use flags#579
lukewarlow wants to merge 1 commit intow3c:mainfrom
lukewarlow:script-protection-v3

lukewarlow commented Feb 3, 2025 •

edited by pr-preview bot

Loading

Uh oh!

lukewarlow commented Feb 3, 2025

Uh oh!

lukewarlow Feb 3, 2025

Uh oh!

annevk Feb 25, 2025

Uh oh!

lukewarlow commented Feb 25, 2025

Uh oh!

fred-wang May 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		1. Set [=this=]'s [=SVGScriptElement/is trusted=] to false.

		1. Run the {{SVGScriptElement\|script}} [=post-connection steps=], given [=this=].

Conversation

lukewarlow commented Feb 3, 2025 • edited by pr-preview bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lukewarlow commented Feb 3, 2025

Uh oh!

lukewarlow Feb 3, 2025

Choose a reason for hiding this comment

Uh oh!

annevk Feb 25, 2025

Choose a reason for hiding this comment

Uh oh!

lukewarlow commented Feb 25, 2025

Uh oh!

fred-wang May 16, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lukewarlow commented Feb 3, 2025 •

edited by pr-preview bot

Loading