1994690 - Ship Trusted Types

Status: RESOLVED FIXED

(Core :: DOM: Security, task)

Description

[Tom Schuster]

Trusted Types is enabled in early beta and earlier only.

Comment 1

[Frederik Braun [:freddy]]

The Trusted Type Spec has been evolved in a collaboration with Igalia and the Chrome team to bring some improvements. This will allow us to implement it with higher confidence and a mature spec that is already in process of being upstreamed to HTML/DOM properly

Given some potentially breaking changes in the Chrome implementations, we have discussed the timing of this shipping in Firefox with our friends in the web compat team. We have been advised to ship after Chrome's update in early 2026 such that any potential site breakage will not be "on us".

For further reference, we'll follow after https://chromestatus.com/feature/5163792014245888 is released.

Comment 2

[Frédéric Wang Nélar]

Chrome's intent to ship for the breaking changes is in discussion: https://groups.google.com/a/chromium.org/g/blink-dev/c/OjQXhCZiXe0/m/VW2bMfeoCgAJ

Comment 3

[Frédéric Wang Nélar]

Attachment: Bug 1994690 - Ship Trusted Types. r=smaug,tschuster

Comment 4

[Hamish Willee]

Is this shipping in release in FF 147? The data compatibility seems to indicate that it is https://github.com/mdn/browser-compat-data/pull/28624

Comment 5

[Frédéric Wang Nélar]

(In reply to Hamish Willee from comment #4)

Is this shipping in release in FF 147? The data compatibility seems to indicate that it is https://github.com/mdn/browser-compat-data/pull/28624

TT is enabled in nightly (1955251) and was enabled in "early beta" (bug 1992941). It is not enabled yet by default. This bug is about doing so, targeting Firefox 148 release. I'm not sure why the BCD PR said 147?

Comment 6

[Frédéric Wang Nélar]

Intent to ship: https://groups.google.com/a/mozilla.org/g/dev-platform/c/WA8vLAbvzB0/m/Xp8kM2H6CgAJ

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/fc6e1acd39e1
https://hg.mozilla.org/integration/autoland/rev/a8570854b6f1
Ship Trusted Types. r=smaug,tschuster,webidl,freddyb

Comment 8

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/a8570854b6f1

Comment 9

[Hamish Willee]

@fredw Thanks very much, and for your comment on the linked issue.

• BCD data has been reverted.
• This happened because there is no way for BCD to differentiate the beta and release when testing the beta
• see continuing thread https://github.com/mdn/browser-compat-data/pull/28624#issuecomment-3636175065 and in particular the last post. This suggests we ask FF to provide a way to runtime enable EARLY_BETA_OR_EARLIER.

I've added a needinfo, but only to ensure you see this, not because I need anything.

Comment 10

[Donal Meehan [:dmeehan]]

:fredw, could you consider nominating this for a release note? (Process info)
See https://bugzilla.mozilla.org/show_bug.cgi?id=1955251#c7 for wording used when this was enabled in Nightly

Comment 11

[Frédéric Wang Nélar]

Release Note Request (optional, but appreciated)
[Why is this notable]: A huge new API.
[Affects Firefox for Android]: Yes
[Suggested wording]: The Trusted Types API, primarily aimed at preventing cross-site scripting attacks, is now supported.
[Links (documentation, blog post, etc)]: https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API

Comment 12

[Frédéric Wang Nélar]

(In reply to Hamish Willee from comment #9)

• see continuing thread https://github.com/mdn/browser-compat-data/pull/28624#issuecomment-3636175065 and in particular the last post. This suggests we ask FF to provide a way to runtime enable EARLY_BETA_OR_EARLIER.

I understand what people actually want is to have a runtime flag to disable "early beta or earlier" preferences in order to get the behavior of "beta or release". So really they want a switch that set all preferences to "beta or release" values. Since the default preference values are based on cpp defines (so set at compilation time) I don't think it's possible right now: https://searchfox.org/firefox-main/source/modules/libpref/init/StaticPrefList.yaml ; I did a quick search on Bugzilla and couldn't find anything related, so feel free to open a new bug for that.

Comment 13

[Donal Meehan [:dmeehan]]

Thanks, added to the Fx148 nightly release notes, please allow 30 minutes for the site to update.
Keeping the relnote-firefox flag as ? to keep it on the radar for inclusion in the final Fx148 release notes.

Comment 14

[Florian Scholz (Open Web Docs)]

I filed https://bugzilla.mozilla.org/show_bug.cgi?id=2005763 to ask for a switch for "early beta or earlier".

Comment 15

[Hamish Willee]

FF148 MDN release work for this can be tracked in https://github.com/mdn/content/issues/42748

This is mostly done, though I am hoping for feedback from FredW on https://github.com/mdn/content/pull/42638#discussion_r2674942952 - if that is answered I think I can finish this. (sorry for all the back and forth)

EDIT: Marked as dev-doc-complete. Still in final reviews, but thanks to update from Fred now have confidence it is correct.

Comment 16

[Donal Meehan [:dmeehan]]

Added to the final Fx148 release notes