Port bug 1931282 - Implement Trusted Types support for DOMParser's parseFromString()
Categories
(Thunderbird :: Upstream Synchronization, task)
Tracking
(thunderbird_esr128 unaffected, thunderbird134 unaffected)
| Tracking | Status | |
|---|---|---|
| thunderbird_esr128 | --- | unaffected |
| thunderbird134 | --- | unaffected |
People
(Reporter: mkmelin, Assigned: mkmelin)
References
Details
(Whiteboard: [tb-build-bustage])
Builds are busted - https://treeherder.mozilla.org/jobs?repo=comm-central&selectedTaskRun=CSyKbIMlQOeJSwHoQA2Vvw.0
Looks like we need to port https://hg.mozilla.org/mozilla-central/rev/5af79555a0c1cf00b695ce26aea7f8b246e5e55a
|
||
Comment 1•3 months ago
|
||
Ah, sorry about that.
Basically the ParseFromString-variant that accepts nsAString has been renamed ParseFromStringInternal to make clear it's only used internally when we are sure the input HTML string is safe (not coming from third-party code). I guess Thunderbird could just use that everywhere it uses ParseFromString.
ParseFromString now instead accepts a TrustedHTMLOrString. It assumes the DOMParser has a non-null mOwner and will do extra sanitization as per the trusted type spec.
|
Assignee | |
Comment 2•3 months ago
|
||
Thanks, we only had one usage. I'll fix that
Pushed by mkmelin@iki.fi:
https://hg.mozilla.org/comm-central/rev/82b5dca8fc07
Port bug 1931282 - Implement Trusted Types support for DOMParser's parseFromString(). rs=bustage-fix
|
|
Assignee | |
Updated•3 months ago
|
Description
•