Closed Bug 1596058 Opened 5 years ago Closed 5 years ago

[wpt-sync] Sync PR 20228 - [Trusted Types] Cover attribute node manipulation with Trusted Types checks.

Categories

(Core :: DOM: Security, task, P4)

Product:
Core
Component:
DOM: Security
Type:
task

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla72
Tracking Flags:
Tracking Status
firefox72 --- fixed

People

(Reporter: mozilla.org, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream][domsecurity-backlog])

Sync web-platform-tests PR 20228 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/20228
Details from upstream follow.

Daniel Vogelheim <vogelheim@chromium.org> wrote:

[Trusted Types] Cover attribute node manipulation with Trusted Types checks.

Element::setAttribute will perform trusted types checks, which (currently)
can be circumvented by obtaining the DOM's attribute node and setting the
value directly. This fixes this bypass, by performing identical checks when
the attribute node values are set, and/or the attribute node is attached to
an element.

Bug: 1008012
Bug: https://github.com/w3c/webappsec-trusted-types/issues/47
Change-Id: I1d8ead85b3fa11821c329e1f4af60c1e85ea8298
Reviewed-on: https://chromium-review.googlesource.com/1911215
WPT-Export-Revision: 67d69bd8827815929e834fbe24d85a38fbd7f837

Component: web-platform-tests → DOM: Security
Product: Testing → Core
Whiteboard: [wptsync downstream] → [wptsync downstream][domsecurity-backlog]
Whiteboard: [wptsync downstream][domsecurity-backlog] → [wptsync downstream]
Whiteboard: [wptsync downstream] → [wptsync downstream][domsecurity-backlog]
Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/5765ef6d9f1a
[wpt PR 20228] - [Trusted Types] Cover attribute node manipulation with Trusted Types checks., a=testonly
https://hg.mozilla.org/integration/autoland/rev/8018f71ccdc6
[wpt PR 20228] - Update wpt metadata, a=testonly
Test result changes from PR not available.

https://hg.mozilla.org/mozilla-central/rev/5765ef6d9f1a
https://hg.mozilla.org/mozilla-central/rev/8018f71ccdc6

Status: NEW → RESOLVED
Closed: 5 years ago
status-firefox72: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla72
You need to log in before you can comment on or make changes to this bug.