1931276 - Implement Trusted Types support for Element/ShadowRoot's setHTMLUnsafe() and innerHTML

Status: RESOLVED FIXED

(Core :: DOM: Security, task)

Description

[Frédéric Wang (:fredw)]

Spec:
https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-parsing-and-serialization
https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#unsafe-html-parsing-methods
https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#the-innerhtml-property

Tests:
https://searchfox.org/mozilla-central/source/testing/web-platform/tests/trusted-types/block-string-assignment-to-Element-setHTMLUnsafe.html
https://searchfox.org/mozilla-central/source/testing/web-platform/tests/trusted-types/block-string-assignment-to-ShadowRoot-setHTMLUnsafe.html

Comment 1

[Frédéric Wang (:fredw)]

Also including ShadowRoot's innerHTML in this bug, which is mentioned in the IDL I linked in comment 0. Element's innerHTML was handled in bug 1913339.

I seems block-string-assignment-to-ShadowRoot-setHTMLUnsafe.html is the only ShadowRoot test but does not try and set innerHTML, so we will need a test for that.

https://searchfox.org/mozilla-central/search?q=shadow&path=testing%2Fweb-platform%2Ftests%2Ftrusted-types&case=false&regexp=false
https://searchfox.org/mozilla-central/search?q=innerHTML&path=testing%2Fweb-platform%2Ftests%2Ftrusted-types%2Fblock-string-assignment-to-ShadowRoot-setHTMLUnsafe.html&case=false&regexp=false

Comment 2

[Frédéric Wang (:fredw)]

Attachment: Bug 1931276 - Implement Trusted Types support for Element/ShadowRoot's setHTMLUnsafe(). r=smaug,#dom-core

Comment 3

[Frédéric Wang (:fredw)]

Attachment: Bug 1931276 - Add a Trusted Type test for setting ShadowRoot's innerHTML. r=smaug

This is essentially a copy of
block-string-assignment-to-ShadowRoot-setHTMLUnsafe.html, replacing
set shadowRoot.setHTMLUnsafe(html) with shadowRoot.innerHTML = html.
Note that innerHTML uses LegacyNullToEmptyString, so setting it to
a null behaves slightly differently.

Comment 4

[Frédéric Wang (:fredw)]

Attachment: Bug 1931276 - Implement Trusted Types support for ShadowRoot's innerHTML. r=smaug,#dom-core

Comment 5

[Frédéric Wang (:fredw)]

https://treeherder.mozilla.org/jobs?repo=try&revision=046acf58e20b8a9f81ac3d6738d69220182a5888

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5c844b35a3e4
Implement Trusted Types support for Element/ShadowRoot's setHTMLUnsafe(). r=smaug,dom-core,peterv
https://hg.mozilla.org/integration/autoland/rev/4b6f5fdc1a0d
Add a Trusted Type test for setting ShadowRoot's innerHTML. r=smaug
https://hg.mozilla.org/integration/autoland/rev/82afe5dba541
Implement Trusted Types support for ShadowRoot's innerHTML. r=smaug

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/49439 for changes under testing/web-platform/tests

Comment 8

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/5c844b35a3e4
https://hg.mozilla.org/mozilla-central/rev/4b6f5fdc1a0d
https://hg.mozilla.org/mozilla-central/rev/82afe5dba541

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot