From a665ee44b44139000ceb41fb8f0b0033a72fae9c Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Thu, 24 Apr 2025 13:32:52 +0100 Subject: [PATCH 1/3] Trusted Types --- dom.bs | 93 +++++++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 76 insertions(+), 17 deletions(-) diff --git a/dom.bs b/dom.bs index 491e2691..3c2db63c 100644 --- a/dom.bs +++ b/dom.bs @@ -54,9 +54,11 @@ spec:html; type:element

This specification depends on the Infra Standard. [[!INFRA]]

Some of the terms used in this specification are defined in Encoding, -Selectors, Web IDL, XML, and Namespaces in XML. +Selectors, Trusted Types, Web IDL, XML, and +Namespaces in XML. [[!ENCODING]] [[!SELECTORS4]] +[[!TRUSTED-TYPES]] [[!WEBIDL]] [[!XML]] [[!XML-NAMES]] @@ -6520,8 +6522,8 @@ interface Element : Node { sequence<DOMString> getAttributeNames(); DOMString? getAttribute(DOMString qualifiedName); DOMString? getAttributeNS(DOMString? namespace, DOMString localName); - [CEReactions] undefined setAttribute(DOMString qualifiedName, DOMString value); - [CEReactions] undefined setAttributeNS(DOMString? namespace, DOMString qualifiedName, DOMString value); + [CEReactions] undefined setAttribute(DOMString qualifiedName, (TrustedType or DOMString) value); + [CEReactions] undefined setAttributeNS(DOMString? namespace, DOMString qualifiedName, (TrustedType or DOMString) value); [CEReactions] undefined removeAttribute(DOMString qualifiedName); [CEReactions] undefined removeAttributeNS(DOMString? namespace, DOMString localName); [CEReactions] boolean toggleAttribute(DOMString qualifiedName, optional boolean force); @@ -6946,6 +6948,14 @@ steps: value. +

To verify attribute value given a {{TrustedType}} or string value, an +attribute attribute, and an Element element: + +

    +

  1. Return the result of calling get Trusted Types-compliant attribute value + given attribute, with element, and value. [[!TRUSTED-TYPES]] +

+
@@ -6998,6 +7008,10 @@ string namespace (default null):

attribute attr and an element element:
    +

  1. Let verifiedValue be the result of + verifying an attribute value given attr's + value, attr, and element. +

  2. If attr's element is neither null nor element, throw an "{{InUseAttributeError!!exception}}" {{DOMException}}. @@ -7013,6 +7027,8 @@ string namespace (default null):

  3. Otherwise, append attr to element. +

  4. Set attr's value to verifiedValue. +

  5. Return oldAttr.

@@ -7024,18 +7040,32 @@ an optional null or string prefix (default null), and an optional nul namespace (default null):
    -
  1. Let attribute be the result of +

  2. Let attribute be the result of getting an attribute given namespace, localName, and element. -

  3. If attribute is null, create an attribute whose namespace is - namespace, namespace prefix is prefix, - local name is localName, value is value, and - node document is element's node document, then - append this attribute to element, and then - return. +

  4. If attribute is null, then set attribute to an attribute whose + namespace is namespace, namespace prefix is + prefix, local name is localName, value is + value, and node document is element's + node document. + +

  5. Let verifiedValue be the result of + verifying an attribute value given value, + attribute, and element. -

  6. Change attribute to value. +

  7. Set attribute to the result of + getting an attribute given + namespace, localName, and element. + +

  8. If attribute is null, create an attribute whose namespace + is namespace, namespace prefix is prefix, + local name is localName, value is + verifiedValue, and node document is element's + node document, then append this attribute to + element, and then return. + +

  9. Change attribute to verifiedValue.

@@ -7294,14 +7324,26 @@ method steps are:

  • Let attribute be the first attribute in this's attribute list whose qualified name is qualifiedName, and null otherwise. - + +

  • If attribute is null, then set attribute to an attribute + whose local name is qualifiedName, value is + value, and node document is this's node document. + +

  • Let verifiedValue be the result of + verifying an attribute value given value, + attribute, and this. + +

  • Set attribute to the first attribute in this's + attribute list whose qualified name is qualifiedName, + and null otherwise.

  • If attribute is null, create an attribute whose local name is qualifiedName, value is - value, and node document is this's node document, - then append this attribute to this, and then return. + verifiedValue, and node document is this's + node document, then append this attribute + to this, and then return. -

  • Change attribute to value. +

  • Change attribute to verifiedValue.

    The @@ -7313,7 +7355,7 @@ method steps are: passing namespace and qualifiedName to validate and extract.

  • Set an attribute value for this using localName, value, - and also prefix and namespace. + prefix, namespace and true.

    The @@ -7891,7 +7933,24 @@ string value, run these steps:

  • If attribute's element is null, then set attribute's value to value. -

  • Otherwise, change attribute to value. +

  • +

    Otherwise: + +

      +

    1. Let originalElement be attribute's element. + +

    2. Let verifiedValue be the result of + verifying an attribute value given value, + attribute, and this. + +

    3. If attribute's element is null, then set attribute's + value to verifiedValue, and return. + +

    4. If attribute's element is not originalElement, then + return. + +

    5. Change attribute to verifiedValue. +

    The {{Attr/value}} setter steps are to set an existing attribute value with this From d86e02f0fb3bb711517f031cf88e499f63d7b18b Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Thu, 24 Apr 2025 13:42:02 +0100 Subject: [PATCH 2/3] Revert change to "set an attribute value" --- dom.bs | 30 ++++++++---------------------- 1 file changed, 8 insertions(+), 22 deletions(-) diff --git a/dom.bs b/dom.bs index 3c2db63c..3fbec60f 100644 --- a/dom.bs +++ b/dom.bs @@ -7040,32 +7040,18 @@ an optional null or string prefix (default null), and an optional nul namespace (default null):

      -

    1. Let attribute be the result of +

    2. Let attribute be the result of getting an attribute given namespace, localName, and element. -

    3. If attribute is null, then set attribute to an attribute whose - namespace is namespace, namespace prefix is - prefix, local name is localName, value is - value, and node document is element's - node document. - -

    4. Let verifiedValue be the result of - verifying an attribute value given value, - attribute, and element. - -

    5. Set attribute to the result of - getting an attribute given - namespace, localName, and element. - -

    6. If attribute is null, create an attribute whose namespace - is namespace, namespace prefix is prefix, - local name is localName, value is - verifiedValue, and node document is element's - node document, then append this attribute to - element, and then return. +

    7. If attribute is null, create an attribute whose namespace is + namespace, namespace prefix is prefix, + local name is localName, value is value, and + node document is element's node document, then + append this attribute to element, and then + return. -

    8. Change attribute to verifiedValue. +

    9. Change attribute to value.

    From 1d257197d6b2cb6edf0968360441e431d5187667 Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Thu, 24 Apr 2025 14:11:53 +0100 Subject: [PATCH 3/3] Update setAttributeNS to include TT check --- dom.bs | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/dom.bs b/dom.bs index 3fbec60f..162c6513 100644 --- a/dom.bs +++ b/dom.bs @@ -7340,8 +7340,32 @@ method steps are:

  • Let namespace, prefix, and localName be the result of passing namespace and qualifiedName to validate and extract. -

  • Set an attribute value for this using localName, value, - prefix, namespace and true. +

  • Let attribute be the result of + getting an attribute given + namespace, localName, and element. + +

  • If attribute is null, then set attribute to an attribute whose + namespace is namespace, namespace prefix is + prefix, local name is localName, value is + value, and node document is element's + node document. + +

  • Let verifiedValue be the result of + verifying an attribute value given value, + attribute, and element. + +

  • Set attribute to the result of + getting an attribute given + namespace, localName, and element. + +

  • If attribute is null, create an attribute whose namespace + is namespace, namespace prefix is prefix, + local name is localName, value is + verifiedValue, and node document is element's + node document, then append this attribute to + element, and then return. + +

  • Change attribute to verifiedValue.

    The