1991658 - Add Origin Trial support for trusted types

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, task)

Description

[Frédéric Wang (:fredw)]

Request form

• Origin trial name: TrustedTypes
• Website (e.g., https://mysite.com): Bug 1845360 is tracking some real usage but I can't find any. Maybe Google has some websites that would be relevant to test too.
• Requires subdomains (yes/no): Depends on the previous answer.
• Suggested expiration date (leave blank if you don't know / don't care):

Additional details

The intent to prototype explains why we want to be careful when shipping this: https://groups.google.com/a/mozilla.org/g/dev-platform/c/zQaRDA68e5A/m/ctVeWrsnAQAJ
so an origin trial makes sense.

Comment 1

[Emilio Cobos Álvarez [:emilio]]

This form is to request a trial. To create a trial, you want to add the [Trial] attribute to WebIDL and so on. You shouldn't need me for that but if you get stuck or what not lmk :)

Comment 2

[Frédéric Wang (:fredw)]

(In reply to Emilio Cobos Álvarez [:emilio] from comment #1)

This form is to request a trial. To create a trial, you want to add the [Trial] attribute to WebIDL and so on. You shouldn't need me for that but if you get stuck or what not lmk :)

Yes I was planning to do so...

Comment 3

[Frédéric Wang (:fredw)]

Attachment: WIP: Bug 1991658 - Add Origin Trial for Trusted Types

• Blocked on bug 1757935 (see Window.trustedTypes attribute).
• Enable CSP parsing of trusted-types, require-trusted-types-for
  directives as well as trusted-types-eval source keyword but that
  shouldn't affect nothing but displayed console warnings.

Comment 4

[Frédéric Wang (:fredw)]

@emilio: Requesting needinfo to you if you have an idea for the first TODO from the commit message (aka bug 1757935). As an alternative, I tested a bit and it seems we can still disable individual members of TrustedTypePolicyFactory so although window.trustedTypes would be defined when trial is off, it won't be possible to use this API.

I'll look at the second TODO tomorrow.

Comment 5

[Emilio Cobos Álvarez [:emilio]]

I'll follow-up in bug 1757935.

Comment 6

[Frédéric Wang (:fredw)]

As an alternative, I tested a bit and it seems we can still disable individual members of TrustedTypePolicyFactory so although window.trustedTypes would be defined when trial is off, it won't be possible to use this API.

Probably this is not a good solution as feature detection is likely to rely on window.trustedTypes. So I guess we really need to fix bug 1757935 first.

Comment 7

[Frédéric Wang (:fredw)]

Given bug 1992941 landed, do we still want an origin trial for TT?

Comment 8

[Frederik Braun [:freddy]]

Given bug 1757935, we should close this WONTFIX :-/

Comment 9

[Emilio Cobos Álvarez [:emilio]]

Should we? it's not unfixable

Comment 10

[Frederik Braun [:freddy]]

It's fixable, but we won't fix it? :-)