1916957 - Implement Trusted Types support for all remaining injection sinks for Windows (not Workers)

Status: NEW

(Core :: DOM: Security, task)

Description

[Mirko Brodesser (:mbrodesser) -- not reading bugmails currently]

The list of dependent tickets is incomplete.

Some other injection sinks to be covered:
For TrustedHTML:

• https://html.spec.whatwg.org/#the-document-object:dom-parsehtmlunsafe
• https://html.spec.whatwg.org/#the-document-object:dom-document-write
• https://html.spec.whatwg.org/#the-document-object:dom-document-writeln
• https://html.spec.whatwg.org/#the-iframe-element:dom-iframe-srcdoc
• https://html.spec.whatwg.org/#dom-parsing-and-serialization:dom-element-sethtmlunsafe
• https://html.spec.whatwg.org/#dom-parsing-and-serialization:dom-element-outerhtml
• https://html.spec.whatwg.org/#dom-parsing-and-serialization:dom-shadowroot-sethtmlunsafe
• https://html.spec.whatwg.org/#dom-parsing-and-serialization:dom-shadowroot-innerhtml
• https://html.spec.whatwg.org/#the-domparser-interface:dom-domparser-parsefromstring-2
• https://html.spec.whatwg.org/#the-createcontextualfragment()-method:dom-range-createcontextualfragment-3

Comment 1

[Frédéric Wang (:fredw)]

So these are the references I have found:

Trusted Types spec:
https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts

HTML spec:
https://html.spec.whatwg.org/multipage/infrastructure.html#tt-trustedhtml
https://html.spec.whatwg.org/multipage/infrastructure.html#tt-trustedscript
https://html.spec.whatwg.org/multipage/infrastructure.html#tt-trustedscripturl

DOM spec:
https://github.com/whatwg/dom/pull/1268

Blink: https://source.chromium.org/search?q=(TrustedHTML%20OR%20TrustedScript%20OR%20TrustedScriptURL%20OR%20TrustedType)%20AND%20filepath:third_party%2Fblink%2Frenderer%2Fcore%20AND%20file:idl&start=1

WebKit: https://searchfox.org/wubkat/search?q=TrustedHTML%7CTrustedScriptURL%7CTrustedScript%7CTrustedType&path=.idl%24&case=false&regexp=true

Gecko: https://searchfox.org/mozilla-central/search?q=TrustedHTML%7CTrustedScriptURL%7CTrustedScript%7CTrustedType&path=.webidl%24&case=false&regexp=true

Comment 2

[Frédéric Wang (:fredw)]

Status update

• Work is done for Element.insertAdjacentHTML and Element.innerHTML using a specialized implementations of "Get Trusted Type policy value" and "Get Trusted Type compliant string" (trustedTypeName/TrustedType/expectedType are always assumed to be TrustedHTML and the the global object to be a Window).
• Uploaded patches make the code work with other type than TrustedHTML and to also implemented "Get Trusted Types-compliant attribute value".
• These patches implement support for the sinks corresponding to the information provided by getAttributeType/getPropertyType: HTMLScriptElement's src/innerText/textContent/text IDL attributes, Element's outerHTML IDL attribute, Element's setAttribute/setAttributeNS.
• Advanced enforcement for scripts has not been implemented for now.

Patch stack

• D227943: Bug 1925468 - Implement Trusted Type support for setAttribute/setAttributeNS.
• D227926: Bug 1925468 - Factor out "Get Trusted Type Data For Attribute".
• D227830: Bug 1928990 - Implement Trusted Types support for iframe srcdoc IDL attribute.
• D227827: Bug 1928991 - Implement Trusted Types support for outerHTML IDL attribute.
• D227513: Bug 1905706 - Trusted Types support for the src/innerText/textContent/text IDL attributes of HTMLScriptElement.
• D227505: Bug 1928318 - Make GetTrustedTypesCompliantString accept a variant of "trusted type or string" values.
• D227479: Bug 1928318 - Make ProcessValueWithADefaultPolicy handle any trusted type.
• D227457: Bug 1928318 - Introduce TrustedType and GetTrustedTypeName().

Try server: https://treeherder.mozilla.org/jobs?repo=try&revision=7c184a5b984949218e85442ef5850c942f371a3a

Comment 3

[Hamish Willee]

MDN docs work for this and other parts of the API in FF135 (ish) can be tracked in https://github.com/mdn/content/issues/37518

@fredw, last time we asked the API was untestable. Is that still the case? If so, can you outline what has been done? So far I have this list https://pr37926.content.dev.mdn.mozit.cloud/en-US/docs/Mozilla/Firefox/Experimental_features#trusted_types_api

I know I need to add the TrustedTypes to that list to (such as TrustedHtml) but wanted to get broad confirmation from you on what interfaces and sinks have testable implementations. If it is still too early we can wait - but we'll have to list everything supported at some point and updated compatibility data.

Comment 4

[Frederik Braun [:freddy] (OOO until August 18th)]

I think you want to look at Trusted Types when bug 1939805 has been resolved. The individual pieces don't make a lot of sense on their own