1944511 - Implement remaining Trusted Type support for attribute changes

Status: RESOLVED FIXED

(Core :: DOM: Security, task)

Description

[Frédéric Wang (:fredw)]

https://github.com/whatwg/dom/pull/1268 mentions "attribute's change, append, and replace"

setAttribute/setAttributeNS was implemented in bug 1925468. However, there are other ways to set attributes that would require similar TT checks too.

Looking at currently failing tests:

• block-string-assignment-to-attribute-via-attribute-node.html: They set the attribute's node value via textContent/nodeValue.
• block-string-assignment-to-Element-setAttribute.html: The remaining failure is a test relying on setAttributeNode().
• Element-setAttribute-respects-Elements-node-documents-globals-CSP-after-adoption-from-non-TT-realm.html: The assertion failures are for setAttributeNode().

Comment 1

[Frédéric Wang (:fredw)]

testing/web-platform/tests/trusted-types/TrustedType-AttributeNodes.html is a test also checks attributenode.value and NamedNodeMap.setNamedItem but it is already passing.

Comment 2

[Frédéric Wang (:fredw)]

List provided by Luke:

• setAttribute
• setAttributeNS
• Element.setAttributeNode
• Element.setAttributeNodeNS
• NamedNodeMap.setNamedItem
• NamedNodeMap.setNamedItemNS
• Attr.value
• Node.textContent
• Node.nodeValue

Comment 3

[Frédéric Wang (:fredw)]

Attachment: Bug 1944511 Implement remaining Trusted Type support for attribute changes. r=smaug

Comment 4

[Frédéric Wang (:fredw)]

Checking the code, nsDOMAttributeMap::SetNamedItemNS and Attr::SetValue should be enough to cover the list in comment 2. However, test coverage is not great for now: https://github.com/whatwg/dom/pull/1268#issuecomment-2621271212

Comment 5

[Frédéric Wang (:fredw)]

Attachment: Bug 1944511 - Add Trusted Type test to set attributes by different means. r=smaug

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/752e5c2d3d68
Add Trusted Type test to set attributes by different means. r=smaug
https://hg.mozilla.org/integration/autoland/rev/90a78c6d0ec0
Implement remaining Trusted Type support for attribute changes. r=smaug

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/50709 for changes under testing/web-platform/tests

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 9

[amarc]

https://hg.mozilla.org/mozilla-central/rev/752e5c2d3d68
https://hg.mozilla.org/mozilla-central/rev/90a78c6d0ec0