Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add missing IDL changes to Parent and Child Node mixins from dom spec #440

Closed
wants to merge 2 commits into from
Closed

Add missing IDL changes to Parent and Child Node mixins from dom spec #440

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1c60cd8
Add missing integration with DOM
lukewarlow Feb 20, 2024
edde5f7
Add missing integration with DOM
lukewarlow Feb 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions spec/index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,8 @@ spec:ECMA-262; urlPrefix: https://tc39.github.io/ecma262/
type:dfn; text:current realm record; url: current-realm
spec: HTML; urlPrefix: https://html.spec.whatwg.org/
type: dfn; text: prepare the script element; url: prepare-the-script-element
spec: DOM; urlPrefix: https://dom.spec.whatwg.org/
type: dfn; text: append; url: concept-node-append
</pre>

<pre class="link-defaults">
Expand Down Expand Up @@ -1476,6 +1478,26 @@ On setting {{SVGAnimatedString/baseVal}}, the following steps are run:

Note: SVG does not have a complete script processing model <a href="https://github.com/w3c/svgwg/issues/196">yet</a>. Trusted Types assumes that the attribute and text body modification protections behave similarly to ones for HTML scripts outlined in [[#enforcement-in-scripts]].

## Integration with DOM ## {#integration-with-dom}

This document modifies the following interfaces defined by [[DOM]]:

<pre class="idl exclude">
partial interface mixin ParentNode {
[CEReactions, Unscopable] undefined prepend((Node or DOMString or TrustedScript)... nodes);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confused: when to use [StringContext=TrustedScript] DOMString and when to use DOMString or TrustedScript?

The former is specified in https://w3c.github.io/trusted-types/dist/spec/#StringContext.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TrustedScript is the object itself, where as [StringContext=TrustedScript] DOMString (or its alias ScriptString) pass the string itself through.

These methods need the raw object because the processing happens at the algorithm level (as it needs to process TextNode content AND strings through a policy)

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TrustedScript is the object itself, where as [StringContext=TrustedScript] DOMString (or its alias ScriptString) pass the string itself through.

These methods need the raw object because the processing happens at the algorithm level (as it needs to process TextNode content AND strings through a policy)

Doesn't it imply someParentNode.prepend(someString) may be called, even if trusted types are enforced?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The linked DOM spec PR updates the relevant algorithms so that the string gets put through the trusted types algos.

[CEReactions, Unscopable] undefined append((Node or DOMString or TrustedScript)... nodes);
[CEReactions, Unscopable] undefined replaceChildren((Node or DOMString or TrustedScript)... nodes);
};

partial interface mixin ChildNode {
[CEReactions, Unscopable] undefined before((Node or DOMString or TrustedScript)... nodes);
[CEReactions, Unscopable] undefined after((Node or DOMString or TrustedScript)... nodes);
[CEReactions, Unscopable] undefined replaceWith((Node or DOMString or TrustedScript)... nodes);
};
</pre>

Issue: Keep in sync with https://github.com/whatwg/dom/pull/1258.

## Integration with DOM Parsing ## {#integration-with-dom-parsing}

This document modifies the following interfaces defined by [[DOM-Parsing]]:
Expand Down
Loading