1905706 - Trusted Types support for the src/innerText/textContent/text IDL attributes of `HTMLScriptElement`

Status: NEW

(Core :: DOM: Security, task)

Description

[Mirko Brodesser (:mbrodesser-Igalia)]

Change

attribute USVString src;
to
attribute (USVString or TrustedScriptURL) src;

as per https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts.
There's still an open spec issue: https://github.com/w3c/trusted-types/issues/525.

That requires implementing https://w3c.github.io/trusted-types/dist/spec/#the-src-idl-attribute.

https://searchfox.org/mozilla-central/rev/e74b86533c2499eb6393071aeedcfb080d84e4da/testing/web-platform/tests/trusted-types/HTMLScriptElement-internal-slot.html#125,134 is a test for that.

Comment 1

[Frédéric Wang (:fredw)]

Attachment: Bug 1905706 - Trusted Types support for the src/innerText/textContent/text IDL attributes of HTMLScriptElement. r=smaug

Comment 2

[Frédéric Wang (:fredw)]

I'll open a separate bug to handle https://github.com/w3c/trusted-types/issues/525 and the trusted/changed by trusted sink booleans thing.

For now, I guess we can just do the easy thing: change the property setter/getter to work with TrustedTypes arguments.