1931290 - Implement Trusted Types support for Window's setInterval()/setTimeout()

Status: RESOLVED FIXED

(Core :: DOM: Security, task)

Description

[Frédéric Wang (:fredw)]

Spec:
https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope-mixin:tt-trustedscript
https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope-mixin:timerhandler
https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope-mixin:timerhandler-2
https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#timers

Tests:
trusted-types/DOMWindowTimers-setTimeout-setInterval.html
block-string-assignment-to-DOMWindowTimers-setTimeout-setInterval.html

Comment 1

[Frédéric Wang (:fredw)]

Attachment: Bug 1931290 - Use "Function or DOMString" in setTimeout/setInterval IDL. r=smaug,#dom-core

Comment 2

[Frédéric Wang (:fredw)]

Attachment: Bug 1931290 - Implement Trusted Types support for Window's setInterval()/setTimeout(). r=smaug,#dom-core

Comment 3

[Frédéric Wang (:fredw)]

Let's only handle the Window case here. I'll open a separate bug for WorkerGlobalScope

Comment 4

[Frédéric Wang (:fredw)]

Just putting here for the record:

https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#timers contains the step

• Perform EnsureCSPDoesNotBlockStringCompilation(realm, « », handler, handler, timer, « », handler). If this throws an exception, catch it, report it for global, and abort these steps.

and https://w3c.github.io/webappsec-csp/#can-compile-strings does not perform any trusted check for TIMER, so we don't need the extra changes for EnsureCSPDoesNotBlockStringCompilation mentioned in bug 1931288 comment 2.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d5a35d40760b
Use "Function or DOMString" in setTimeout/setInterval IDL. r=smaug
https://hg.mozilla.org/integration/autoland/rev/7f2360c92457
Implement Trusted Types support for Window's setInterval()/setTimeout(). r=smaug

Comment 6

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/d5a35d40760b
https://hg.mozilla.org/mozilla-central/rev/7f2360c92457