Ff145 Trusted Types follow on #28350

hamishwillee · 2025-11-03T01:06:23Z

This follows #28302 with updates for a few more trusted type injection sinks. These originate from a big list generated here:
w3c/trusted-types#494 (comment)

Firefox supports these. I have marked up how I tested them inline.

Related docs work can be tracked in #41507

FYI only - Note these things are the ones in wpt that I have added because they are standard. There are still some non standard ones I have chosen NOT to cover these yet because FF doesn't support them, they might be reverted or accepted, and I don't have time in this release cycle.

FWIW, Chromium also implemented some stuff that are not in the TrustedTypes specification, I believe injection sinks for embed/object elements (see https://wpt.live/trusted-types/legacy-trusted-script-urls.html), beforecreatepolicy (bug 1950598, I believe they plan to unship it) or fromLiteral (bug 1950600, we plan to implement it in Firefox).

github-actions · 2025-11-03T01:07:05Z

Tip: Review these changes grouped by change (recommended for most PRs), or grouped by feature (for large PRs).

hamishwillee · 2025-11-03T01:10:16Z

api/Document.json

+              "deprecated": true
+            }
+          },
+          "enforces_trusted_types": {


Note, in this case of insertHTML I have created insertHTML feature first and then nested this enforces_trusted_types

My reasoning is that this only affects insertHTML and there are a lot of other options. We could instead put this as same level as the parent feature if you prefer and in description: insertHTML() requires ...

Tested on browserstack using https://wpt.live/trusted-types/block-Document-execCommand.html

hamishwillee · 2025-11-03T01:14:13Z

api/Element.json

            "deprecated": false
          }
+        },
+        "enforces_trusted_types": {


Versions tested using https://wpt.live/trusted-types/block-string-assignment-to-Element-setAttribute.html

The description is overly long. If you follow the spec https://wpt.live/trusted-types/block-string-assignment-to-Element-setAttributeNS.html you see that https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute%E2%91%A0 which shows that this applies to

Element Attribute namespace Attribute local name TrustedType Sink HTMLIFrameElement null "srcdoc" TrustedHTML "HTMLIFrameElement srcdoc" HTMLScriptElement null "src" TrustedScriptURL "HTMLScriptElement src" SVGScriptElement null "href" TrustedScriptURL "SVGScriptElement href" SVGScriptElement XLink namespace "href" TrustedScriptURL "SVGScriptElement href"

For the NS case I tried a different description

"value parameter requires TrustedHTML, TrustedScript, or TrustedScriptURL instance when trusted types enforced (matching attribute type)",

What I'm trying to do is find a shorter string that captures "the TT enforced if setting attribute directly on the equivalent property would be enforced".

hamishwillee · 2025-11-03T01:20:47Z

api/Element.json

+        },
+        "enforces_trusted_types": {
+          "__compat": {
+            "description": "`value` parameter requires `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",


Testing using https://wpt.live/trusted-types/block-string-assignment-to-Element-setAttributeNS.html

Note that while the spec seems to point to the same place as the non NS version ( See https://github.com/mdn/browser-compat-data/pull/28350/files#r2485142295 ) the test is different. This might therefore be wrong. I'm asking in https://bugzilla.mozilla.org/show_bug.cgi?id=1992941#c10

Suggested change

"description": "`value` parameter requires `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",

"description": "Requires `value` parameter to be `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",

hamishwillee · 2025-11-03T01:21:33Z

api/SharedWorker.json

        },
+        "enforces_trusted_types": {
+          "__compat": {
+            "description": "`url` parameter requires `TrustedScriptURL` instance when trusted types are enforced",


Tested with https://wpt.live/trusted-types/DedicatedWorker-constructor-from-DedicatedWorker.html - yes, I know this is dedicated worker, I'm assuming they are the same

hamishwillee · 2025-11-03T01:22:22Z

api/Worker.json

        },
+        "enforces_trusted_types": {
+          "__compat": {
+            "description": "`url` parameter requires `TrustedScriptURL` instance when trusted types are enforced",


Tested with https://wpt.live/trusted-types/DedicatedWorker-constructor-from-DedicatedWorker.html

Note, I didn't nest this as a property of an URL sub feature. WOuld you prefer that? Ditto for the SharedWorker

Suggested change

"description": "`url` parameter requires `TrustedScriptURL` instance when trusted types are enforced",

"description": "Requires `url` parameter to be `TrustedScriptURL` instance when trusted types are enforced",

hamishwillee · 2025-11-03T01:22:48Z

javascript/builtins/Function.json

+          },
+          "enforces_trusted_types": {
+            "__compat": {
+              "description": "Arguments require `TrustedScript` instance when trusted types are enforced",


Tested with https://wpt.live/trusted-types/eval-function-constructor-untrusted-arguments-and-applying-default-policy.html

Suggested change

"description": "Arguments require `TrustedScript` instance when trusted types are enforced",

"description": "Requires arguments to be `TrustedScript` instance when trusted types are enforced",

caugner · 2025-11-04T14:15:51Z

api/Document.json

+                  "version_added": "1",
+                  "version_removed": "69",
+                  "partial_implementation": true,
+                  "notes": "Only supported for [`HTMLDocument`](https://developer.mozilla.org/docs/Web/API/HTMLDocument), not all `Document` objects."


Is there a bug that captures generalizing the implementation for all Document objects?

caugner · 2025-11-04T14:17:35Z

api/Document.json

+                "standard_track": false,
+                "deprecated": true


Is this really deprecated? Should it not be:

Suggested change

"standard_track": false,

"deprecated": true

"standard_track": true,

"deprecated": false

caugner · 2025-11-04T14:20:13Z

api/Element.json

+        },
+        "enforces_trusted_types": {
+          "__compat": {
+            "description": "When trusted types are enforced `value` parameter requires `TrustedHTML` instance for `iframe.srcdoc` and `TrustedScriptURL` for HTML `script.src` and SVG `script.href`",


Suggested change

"description": "When trusted types are enforced `value` parameter requires `TrustedHTML` instance for `iframe.srcdoc` and `TrustedScriptURL` for HTML `script.src` and SVG `script.href`",

"description": "Requires `value` parameter to be `TrustedHTML` instance (for `iframe.srcdoc`), or `TrustedScriptURL` (for HTML `script.src`, and SVG `script.href`) when trusted types are enforced",

caugner · 2025-11-04T14:20:58Z

api/Element.json

+            "status": {
+              "experimental": false,
+              "standard_track": true,
+              "deprecated": true


Same:

Suggested change

"deprecated": true

"deprecated": false

caugner · 2025-11-04T14:21:25Z

api/Element.json

+        },
+        "enforces_trusted_types": {
+          "__compat": {
+            "description": "`value` parameter requires `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",


Suggested change

"description": "`value` parameter requires `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",

"description": "Requires `value` parameter to be `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",

caugner · 2025-11-04T14:21:41Z

api/Element.json

+            "status": {
+              "experimental": false,
+              "standard_track": true,
+              "deprecated": true


Suggested change

"deprecated": true

caugner · 2025-11-04T14:22:02Z

api/Worker.json

        },
+        "enforces_trusted_types": {
+          "__compat": {
+            "description": "`url` parameter requires `TrustedScriptURL` instance when trusted types are enforced",


Suggested change

"description": "`url` parameter requires `TrustedScriptURL` instance when trusted types are enforced",

"description": "Requires `url` parameter to be `TrustedScriptURL` instance when trusted types are enforced",

caugner · 2025-11-04T14:22:15Z

javascript/builtins/Function.json

+          },
+          "enforces_trusted_types": {
+            "__compat": {
+              "description": "Arguments require `TrustedScript` instance when trusted types are enforced",


Suggested change

"description": "Arguments require `TrustedScript` instance when trusted types are enforced",

"description": "Requires arguments to be `TrustedScript` instance when trusted types are enforced",

caugner · 2025-11-04T14:22:48Z

api/Document.json

+              "standard_track": false,
+              "deprecated": true


Isn't this standard track? (And if yes, what spec URL could we set?)

Suggested change

"standard_track": false,

"deprecated": true

"standard_track": true,

"deprecated": false

hamishwillee added 7 commits November 3, 2025 10:30

FF145 Worker url param TrustedScriptURL

f406dea

FF145 SharedWorker url param TrustedScriptURL

fc6c563

FF145 Document.execCommand insertHTML requires TrustedHTML

3b27347

Element.setAttribute() and setAttributeNS() require TT

a236380

Function() constructor requires TrustedScript

2d2318b

Document.execcommand fix chrome

c6d0be4

Fix sharedworker

891e92e

github-actions bot added data:api Compat data for Web APIs. https://developer.mozilla.org/docs/Web/API data:js Compat data for JS/ECMAScript features. https://developer.mozilla.org/docs/Web/JavaScript size:l [PR only] 101-1000 LoC changed labels Nov 3, 2025

hamishwillee commented Nov 3, 2025

View reviewed changes

hamishwillee mentioned this pull request Nov 3, 2025

[WebAPI] Enable Trusted Types in early beta mdn/content#41507

Open

8 tasks

caugner self-requested a review November 4, 2025 13:43

caugner requested changes Nov 4, 2025

View reviewed changes

	"description": "`value` parameter requires `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",
	"description": "Requires `value` parameter to be `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",

	"description": "`url` parameter requires `TrustedScriptURL` instance when trusted types are enforced",
	"description": "Requires `url` parameter to be `TrustedScriptURL` instance when trusted types are enforced",

	"description": "Arguments require `TrustedScript` instance when trusted types are enforced",
	"description": "Requires arguments to be `TrustedScript` instance when trusted types are enforced",

	"description": "When trusted types are enforced `value` parameter requires `TrustedHTML` instance for `iframe.srcdoc` and `TrustedScriptURL` for HTML `script.src` and SVG `script.href`",
	"description": "Requires `value` parameter to be `TrustedHTML` instance (for `iframe.srcdoc`), or `TrustedScriptURL` (for HTML `script.src`, and SVG `script.href`) when trusted types are enforced",

Ff145 Trusted Types follow on #28350

Are you sure you want to change the base?

Ff145 Trusted Types follow on #28350

Conversation

hamishwillee commented Nov 3, 2025

Uh oh!

github-actions bot commented Nov 3, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants