Skip to content

Ff145 Trusted Types follow on #28350

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Ff145 Trusted Types follow on #28350

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f406dea
FF145 Worker url param TrustedScriptURL
hamishwillee Nov 2, 2025
fc6c563
FF145 SharedWorker url param TrustedScriptURL
hamishwillee Nov 2, 2025
3b27347
FF145 Document.execCommand insertHTML requires TrustedHTML
hamishwillee Nov 3, 2025
a236380
Element.setAttribute() and setAttributeNS() require TT
hamishwillee Nov 3, 2025
2d2318b
Function() constructor requires TrustedScript
hamishwillee Nov 3, 2025
c6d0be4
Document.execcommand fix chrome
hamishwillee Nov 3, 2025
891e92e
Fix sharedworker
hamishwillee Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 83 additions & 0 deletions api/Document.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3523,6 +3523,89 @@
"deprecated": true
}
}
},
"insertHTML": {
"__compat": {
"description": "`insertHTML` command",
"support": {
"chrome": {
"version_added": "1"
},
"chrome_android": "mirror",
"edge": {
"version_added": "12"
},
"firefox": [
{
"version_added": "69",
"notes": [
"From Firefox 82, nested calls are not supported (return `false`). See [bug 1634262](https://bugzil.la/1634262).",
"Before Firefox 89, manipulating the content of `<input>` and `<textarea>` elements using `Document.execCommand()` commands requires workarounds (see [bug 1220696](https://bugzil.la/1220696))."
]
},
{
"version_added": "1",
"version_removed": "69",
"partial_implementation": true,
"notes": "Only supported for [`HTMLDocument`](https://developer.mozilla.org/docs/Web/API/HTMLDocument), not all `Document` objects."
Copy link
Contributor

@caugner caugner Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a bug that captures generalizing the implementation for all Document objects?

}
],
"firefox_android": "mirror",
"ie": {
"version_added": "4"
},
"oculus": "mirror",
"opera": {
"version_added": "9"
},
"opera_android": {
"version_added": "10.1"
},
"safari": {
"version_added": "1.3"
},
"safari_ios": "mirror",
"samsunginternet_android": "mirror",
"webview_android": "mirror",
"webview_ios": "mirror"
},
"status": {
"experimental": false,
"standard_track": false,
"deprecated": true
Comment on lines +3574 to +3575
Copy link
Contributor

@caugner caugner Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this standard track? (And if yes, what spec URL could we set?)

Suggested change
"standard_track": false,
"deprecated": true
"standard_track": true,
"deprecated": false

}
},
"enforces_trusted_types": {
Copy link
Contributor Author

@hamishwillee hamishwillee Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Note, in this case of insertHTML I have created insertHTML feature first and then nested this enforces_trusted_types
    • My reasoning is that this only affects insertHTML and there are a lot of other options. We could instead put this as same level as the parent feature if you prefer and in description: insertHTML() requires ...
  2. Tested on browserstack using https://wpt.live/trusted-types/block-Document-execCommand.html

"__compat": {
"description": "Requires `TrustedHTML` instance when trusted types are enforced",
"support": {
"chrome": {
"version_added": "96"
},
"chrome_android": "mirror",
"edge": "mirror",
"firefox": {
"version_added": "preview"
},
"firefox_android": "mirror",
"oculus": "mirror",
"opera": "mirror",
"opera_android": "mirror",
"safari": {
"version_added": "26"
},
"safari_ios": "mirror",
"samsunginternet_android": "mirror",
"webview_android": "mirror",
"webview_ios": "mirror"
},
"status": {
"experimental": false,
"standard_track": false,
"deprecated": true
Comment on lines +3604 to +3605
Copy link
Contributor

@caugner caugner Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this really deprecated? Should it not be:

Suggested change
"standard_track": false,
"deprecated": true
"standard_track": true,
"deprecated": false

}
}
}
}
},
"exitFullscreen": {
Expand Down
62 changes: 62 additions & 0 deletions api/Element.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10073,6 +10073,37 @@
"standard_track": true,
"deprecated": false
}
},
"enforces_trusted_types": {
Copy link
Contributor Author

@hamishwillee hamishwillee Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Versions tested using https://wpt.live/trusted-types/block-string-assignment-to-Element-setAttribute.html

The description is overly long. If you follow the spec https://wpt.live/trusted-types/block-string-assignment-to-Element-setAttributeNS.html you see that https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute%E2%91%A0 which shows that this applies to

Element	Attribute namespace	Attribute local name	TrustedType	Sink
HTMLIFrameElement	null	"srcdoc"	TrustedHTML	"HTMLIFrameElement srcdoc"
HTMLScriptElement	null	"src"	TrustedScriptURL	"HTMLScriptElement src"
SVGScriptElement	null	"href"	TrustedScriptURL	"SVGScriptElement href"
SVGScriptElement	XLink namespace	"href"	TrustedScriptURL	"SVGScriptElement href"

For the NS case I tried a different description

"value parameter requires TrustedHTML, TrustedScript, or TrustedScriptURL instance when trusted types enforced (matching attribute type)",

What I'm trying to do is find a shorter string that captures "the TT enforced if setting attribute directly on the equivalent property would be enforced".

"__compat": {
"description": "When trusted types are enforced `value` parameter requires `TrustedHTML` instance for `iframe.srcdoc` and `TrustedScriptURL` for HTML `script.src` and SVG `script.href`",
Copy link
Contributor

@caugner caugner Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"description": "When trusted types are enforced `value` parameter requires `TrustedHTML` instance for `iframe.srcdoc` and `TrustedScriptURL` for HTML `script.src` and SVG `script.href`",
"description": "Requires `value` parameter to be `TrustedHTML` instance (for `iframe.srcdoc`), or `TrustedScriptURL` (for HTML `script.src`, and SVG `script.href`) when trusted types are enforced",

"support": {
"chrome": {
"version_added": "83"
},
"chrome_android": "mirror",
"edge": "mirror",
"firefox": {
"version_added": "preview"
},
"firefox_android": "mirror",
"oculus": "mirror",
"opera": "mirror",
"opera_android": "mirror",
"safari": {
"version_added": "26"
},
"safari_ios": "mirror",
"samsunginternet_android": "mirror",
"webview_android": "mirror",
"webview_ios": "mirror"
},
"status": {
"experimental": false,
"standard_track": true,
"deprecated": true
Copy link
Contributor

@caugner caugner Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same:

Suggested change
"deprecated": true
"deprecated": false

}
}
}
},
"setAttributeNode": {
Expand Down Expand Up @@ -10207,6 +10238,37 @@
"standard_track": true,
"deprecated": false
}
},
"enforces_trusted_types": {
"__compat": {
"description": "`value` parameter requires `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",
Copy link
Contributor Author

@hamishwillee hamishwillee Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Testing using https://wpt.live/trusted-types/block-string-assignment-to-Element-setAttributeNS.html

Note that while the spec seems to point to the same place as the non NS version ( See https://github.com/mdn/browser-compat-data/pull/28350/files#r2485142295 ) the test is different. This might therefore be wrong. I'm asking in https://bugzilla.mozilla.org/show_bug.cgi?id=1992941#c10

Copy link
Contributor

@caugner caugner Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"description": "`value` parameter requires `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",
"description": "Requires `value` parameter to be `TrustedHTML`, `TrustedScript`, or `TrustedScriptURL` instance when trusted types enforced (matching attribute type)",

"support": {
"chrome": {
"version_added": "83"
},
"chrome_android": "mirror",
"edge": "mirror",
"firefox": {
"version_added": "preview"
},
"firefox_android": "mirror",
"oculus": "mirror",
"opera": "mirror",
"opera_android": "mirror",
"safari": {
"version_added": "26"
},
"safari_ios": "mirror",
"samsunginternet_android": "mirror",
"webview_android": "mirror",
"webview_ios": "mirror"
},
"status": {
"experimental": false,
"standard_track": true,
"deprecated": true
Copy link
Contributor

@caugner caugner Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"deprecated": true

}
}
}
},
"setCapture": {
Expand Down
39 changes: 39 additions & 0 deletions api/SharedWorker.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,45 @@
}
}
},
"enforces_trusted_types": {
"__compat": {
"description": "`url` parameter requires `TrustedScriptURL` instance when trusted types are enforced",
Copy link
Contributor Author

@hamishwillee hamishwillee Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested with https://wpt.live/trusted-types/DedicatedWorker-constructor-from-DedicatedWorker.html - yes, I know this is dedicated worker, I'm assuming they are the same

"support": {
"chrome": {
"version_added": "97"
},
"chrome_android": {
"version_added": false
},
"deno": {
"version_added": false
},
"edge": "mirror",
"firefox": {
"version_added": "preview"
},
"firefox_android": "mirror",
"nodejs": {
"version_added": false
},
"oculus": "mirror",
"opera": "mirror",
"opera_android": "mirror",
"safari": {
"version_added": "26"
},
"safari_ios": "mirror",
"samsunginternet_android": "mirror",
"webview_android": "mirror",
"webview_ios": "mirror"
},
"status": {
"experimental": false,
"standard_track": true,
"deprecated": false
}
}
},
"mime_checks": {
"__compat": {
"description": "Strict MIME type checks for shared worker scripts",
Expand Down
37 changes: 37 additions & 0 deletions api/Worker.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,43 @@
}
}
},
"enforces_trusted_types": {
"__compat": {
"description": "`url` parameter requires `TrustedScriptURL` instance when trusted types are enforced",
Copy link
Contributor Author

@hamishwillee hamishwillee Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested with https://wpt.live/trusted-types/DedicatedWorker-constructor-from-DedicatedWorker.html

Note, I didn't nest this as a property of an URL sub feature. WOuld you prefer that? Ditto for the SharedWorker

Copy link
Contributor

@caugner caugner Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"description": "`url` parameter requires `TrustedScriptURL` instance when trusted types are enforced",
"description": "Requires `url` parameter to be `TrustedScriptURL` instance when trusted types are enforced",

"support": {
"chrome": {
"version_added": "97"
},
"chrome_android": "mirror",
"deno": {
"version_added": false
},
"edge": "mirror",
"firefox": {
"version_added": "preview"
},
"firefox_android": "mirror",
"nodejs": {
"version_added": false
},
"oculus": "mirror",
"opera": "mirror",
"opera_android": "mirror",
"safari": {
"version_added": "26"
},
"safari_ios": "mirror",
"samsunginternet_android": "mirror",
"webview_android": "mirror",
"webview_ios": "mirror"
},
"status": {
"experimental": false,
"standard_track": true,
"deprecated": false
}
}
},
"mime_checks": {
"__compat": {
"description": "Strict MIME type checks for worker scripts",
Expand Down
32 changes: 32 additions & 0 deletions javascript/builtins/Function.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,38 @@
"standard_track": true,
"deprecated": false
}
},
"enforces_trusted_types": {
"__compat": {
"description": "Arguments require `TrustedScript` instance when trusted types are enforced",
Copy link
Contributor Author

@hamishwillee hamishwillee Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested with https://wpt.live/trusted-types/eval-function-constructor-untrusted-arguments-and-applying-default-policy.html

Copy link
Contributor

@caugner caugner Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"description": "Arguments require `TrustedScript` instance when trusted types are enforced",
"description": "Requires arguments to be `TrustedScript` instance when trusted types are enforced",

"spec_url": "https://w3c.github.io/trusted-types/dist/spec/#dom-htmlscriptelement-innertext",
"support": {
"chrome": {
"version_added": false
},
"chrome_android": "mirror",
"edge": "mirror",
"firefox": {
"version_added": "preview"
},
"firefox_android": "mirror",
"oculus": "mirror",
"opera": "mirror",
"opera_android": "mirror",
"safari": {
"version_added": "26"
},
"safari_ios": "mirror",
"samsunginternet_android": "mirror",
"webview_android": "mirror",
"webview_ios": "mirror"
},
"status": {
"experimental": false,
"standard_track": true,
"deprecated": false
}
}
}
},
"apply": {
Expand Down