1935431 - Support showing the trusted types string in the developer console

Status: RESOLVED FIXED

(DevTools :: Console, enhancement, P2)

Description

[Mirko Brodesser (:mbrodesser) -- not reading bugmails currently]

STR:

1. Set the "dom.security.trusted_types.enabled" pref to true.
2. Open https://jsfiddle.net/c9mg4zqp/ and check the developer console.

Expected: "TrustedHTML {vv}" is logged
Actual: "TrustedHTML { }" is logged

Chrome behaves as expected.

Comment 1

[Frederik Braun [:freddy]]

Agreed, this would be great to get in. Reminds me of bug 1652671 ;-)

Comment 2

[Julian Descottes [:jdescottes]]

Could also be nice to add a link to the createHTML function used by the TrustedHTML.
Since TrustedHTML is being worked on in Firefox at the moment, it would be nice to work on this soon-ish.

Comment 3

[Nicolas Chevobbe [:nchevobbe]]

Mirko, it seems that what you want is something similar than in Chrome, where they show the result of toString() I guess ?
Is there anything else we could show somehow? As Julian said, we discussed in triage and thought it could be nice to somehow print the createHTML function from the TrustedTypePolicy. Do you think we could expose a ChromeOnly policy getter on TrustedHTML ?
Also should we think of handling TrustedScript and TrustedScriptURL as well?

Thanks!

Comment 4

[Mirko Brodesser (:mbrodesser) -- not reading bugmails currently]

(In reply to Nicolas Chevobbe [:nchevobbe] from comment #3)

Mirko, it seems that what you want is something similar than in Chrome, where they show the result of toString() I guess ?

Yes.

Is there anything else we could show somehow?

That might be superfluous.

As Julian said, we discussed in triage and thought it could be nice to somehow print the createHTML function from the TrustedTypePolicy. Do you think we could expose a ChromeOnly policy getter on TrustedHTML ?
Also should we think of handling TrustedScript and TrustedScriptURL as well?

Yes, TrustedScript* should be handled too.

Thanks!

Comment 5

[Mirko Brodesser (:mbrodesser) -- not reading bugmails currently]

CC Fred, since he took over the work on Trusted Types from me.

Comment 6

[Nicolas Chevobbe [:nchevobbe]]

Attachment: Bug 1935431 - Expose TrustedHTML, TrustedScript and TrustedScriptURL in DevTools sandbox. r=gsvelto.

This is needed to add meaningful previews for instances of those classes in
the console.
Tests are added in next patch.

Comment 7

[Nicolas Chevobbe [:nchevobbe]]

Attachment: Bug 1935431 - [devtools] Add specific previewers for TrustedHTML, TrustedScript and TrustedScriptURL objects. r=#devtools.

Comment 8

[Gabriele Svelto [:gsvelto]]

Are you sure that my review request is correct? I am not a peer of this module so can't review patches.

Comment 9

[Nicolas Chevobbe [:nchevobbe]]

(In reply to Gabriele Svelto [:gsvelto] from comment #8)

Are you sure that my review request is correct? I am not a peer of this module so can't review patches.

last time I made changes to the Sandbox.cpp file, smaug asked you to review the patch, so I thought it would be the same here :)
I'll ask smaug as well

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5cdfde163954
Expose TrustedHTML, TrustedScript and TrustedScriptURL in DevTools sandbox. r=devtools-reviewers,smaug.
https://hg.mozilla.org/integration/autoland/rev/d0045739b9f8
[devtools] Add specific previewers for TrustedHTML, TrustedScript and TrustedScriptURL objects. r=devtools-reviewers,jdescottes.

Comment 11

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/5cdfde163954
https://hg.mozilla.org/mozilla-central/rev/d0045739b9f8

Comment 12

[Frédéric Wang (:fredw)]

I think others already replied. I don't have strong opinions on this, but whatever facilitate debugging for web developers sounds good. And yes, TrustedScript/TrustedScriptURL should always be handled the same as TrustedHTML.