From 10507bcb292c24fee4a4dee3fd04edb3a338fe83 Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Wed, 24 Jul 2024 04:42:57 -0700 Subject: [PATCH] Remove trusted types enforcement from DOM node APIs https://bugs.webkit.org/show_bug.cgi?id=276881 Reviewed by Ryosuke Niwa. The enforcement of Trusted Types in various node manipulation APIs in DOM was based on a previous model for protecting script elements. This patch removes it as its not needed. See https://github.com/whatwg/dom/pull/1299 and https://github.com/w3c/trusted-types/issues/537 * LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-tt-enforced-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-tt-enforced.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-Node-multiple-arguments.html. * Source/WebCore/dom/ChildNode.idl: * Source/WebCore/dom/ContainerNode.cpp: (WebCore::ContainerNode::append): (WebCore::ContainerNode::prepend): (WebCore::ContainerNode::replaceChildren): * Source/WebCore/dom/ContainerNode.h: * Source/WebCore/dom/Node.cpp: (WebCore::nodeSetPreTransformedFromNodeOrStringVector): (WebCore::Node::convertNodesOrStringsIntoNode): (WebCore::Node::convertNodesOrStringsIntoNodeVector): (WebCore::Node::before): (WebCore::Node::after): (WebCore::Node::replaceWith): (WebCore::nodeSetPreTransformedFromNodeOrStringOrTrustedScriptVector): Deleted. (WebCore::Node::convertNodesOrStringsOrTrustedScriptsIntoNode): Deleted. (WebCore::Node::convertNodesOrStringsOrTrustedScriptsIntoNodeVector): Deleted. * Source/WebCore/dom/Node.h: * Source/WebCore/dom/ParentNode.idl: * Source/WebCore/dom/TrustedType.cpp: (WebCore::processNodeOrStringAsTrustedType): Deleted. * Source/WebCore/dom/TrustedType.h: Canonical link: https://commits.webkit.org/281285@main --- .../Node-multiple-arguments-expected.txt | 2 + ...ultiple-arguments-tt-enforced-expected.txt | 202 ++++++++++++++++++ ... Node-multiple-arguments-tt-enforced.html} | 10 +- Source/WebCore/dom/ChildNode.idl | 6 +- Source/WebCore/dom/ContainerNode.cpp | 12 +- Source/WebCore/dom/ContainerNode.h | 6 +- Source/WebCore/dom/Node.cpp | 79 +++---- Source/WebCore/dom/Node.h | 15 +- Source/WebCore/dom/ParentNode.idl | 6 +- Source/WebCore/dom/TrustedType.cpp | 28 +-- Source/WebCore/dom/TrustedType.h | 5 - 11 files changed, 256 insertions(+), 115 deletions(-) create mode 100644 LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-tt-enforced-expected.txt rename LayoutTests/imported/w3c/web-platform-tests/trusted-types/{block-Node-multiple-arguments.html => Node-multiple-arguments-tt-enforced.html} (92%) diff --git a/LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-expected.txt index 1732636fcc5c5..70830ba301ec8 100644 --- a/LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-expected.txt +++ b/LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-expected.txt @@ -22,6 +22,7 @@ 'mixed'; 'mixed'; 'mixed'; +'mixed'; 'mixed';'script'; 'mixed';'script'; 'mixed';'script'; @@ -31,6 +32,7 @@ 'script'; 'script'; 'script'; +'script'; PASS replaceWith('createScript';) on
should pass PASS after('createScript';) on
should pass diff --git a/LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-tt-enforced-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-tt-enforced-expected.txt new file mode 100644 index 0000000000000..cbb87a7b67425 --- /dev/null +++ b/LayoutTests/imported/w3c/web-platform-tests/trusted-types/Node-multiple-arguments-tt-enforced-expected.txt @@ -0,0 +1,202 @@ +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +CONSOLE MESSAGE: This requires a TrustedScript value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'" +'createScript'; +'createScript'; +'createScript'; +'createScript'; +'createScript'; +'createScript #1';'#2;' +'createScript #1';'#2;' +'createScript #1';'#2;' +'createScript #1';'#2;' +'createScript #1';'#2;' +'plain text'; +'plain text'; +'plain text'; +'plain text'; +'plain text'; +'plain text #1';'plain text #2'; +'plain text #1';'plain text #2'; +'plain text #1';'plain text #2'; +'plain text #1';'plain text #2'; +'plain text #1';'plain text #2'; +'mixed'; +'mixed'; +'mixed'; +'mixed'; +'mixed'; +'mixed';'script'; +'mixed';'script'; +'mixed';'script'; +'mixed';'script'; +'mixed';'script'; +'script'; +'script'; +'script'; +'script'; +'script'; + +PASS replaceWith('createScript';) on
should pass +PASS after('createScript';) on
should pass +PASS before('createScript';) on
should pass +PASS append('createScript';) on
should pass +PASS prepend('createScript';) on
should pass +PASS replaceWith('createScript #1';,'#2;') on
should pass +PASS after('createScript #1';,'#2;') on
should pass +PASS before('createScript #1';,'#2;') on
should pass +PASS append('createScript #1';,'#2;') on
should pass +PASS prepend('createScript #1';,'#2;') on
should pass +PASS replaceWith('plain text';) on
should pass +PASS after('plain text';) on
should pass +PASS before('plain text';) on
should pass +PASS append('plain text';) on
should pass +PASS prepend('plain text';) on
should pass +PASS replaceWith('plain text #1';,'plain text #2';) on
should pass +PASS after('plain text #1';,'plain text #2';) on
should pass +PASS before('plain text #1';,'plain text #2';) on
should pass +PASS append('plain text #1';,'plain text #2';) on
should pass +PASS prepend('plain text #1';,'plain text #2';) on
should pass +PASS replaceWith([object Text]) on
should pass +PASS after([object Text]) on
should pass +PASS before([object Text]) on
should pass +PASS append([object Text]) on
should pass +PASS prepend([object Text]) on
should pass +PASS replaceWith([object Text],[object Text]) on
should pass +PASS after([object Text],[object Text]) on
should pass +PASS before([object Text],[object Text]) on
should pass +PASS append([object Text],[object Text]) on
should pass +PASS prepend([object Text],[object Text]) on
should pass +PASS replaceWith('mixed';,[object Text]) on
should pass +PASS after('mixed';,[object Text]) on
should pass +PASS before('mixed';,[object Text]) on
should pass +PASS append('mixed';,[object Text]) on
should pass +PASS prepend('mixed';,[object Text]) on
should pass +PASS replaceWith('mixed';,'script';) on
should pass +PASS after('mixed';,'script';) on
should pass +PASS before('mixed';,'script';) on
should pass +PASS append('mixed';,'script';) on
should pass +PASS prepend('mixed';,'script';) on
should pass +PASS replaceWith([object Text],'script';) on
should pass +PASS after([object Text],'script';) on
should pass +PASS before([object Text],'script';) on
should pass +PASS append([object Text],'script';) on
should pass +PASS prepend([object Text],'script';) on
should pass +PASS replaceWith('createScript';) on