From 24bd116cbf1e36d3e6eb3e896bb06af7eefe8165 Mon Sep 17 00:00:00 2001
From: Luke Warlow <lwarlow@igalia.com>
Date: Mon, 9 Sep 2024 15:10:46 +0000
Subject: [PATCH] Remove CSP dynamic code compilation block (#544)

SHA: 1c98273966a4834cee4cdf5a3ccdb2d0b9d2046d
Reason: push, by lukewarlow

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 dist/spec/index.html | 38 +++++++++++++++-----------------------
 1 file changed, 15 insertions(+), 23 deletions(-)

diff --git a/dist/spec/index.html b/dist/spec/index.html
index 291391a..1117aca 100644
--- a/dist/spec/index.html
+++ b/dist/spec/index.html
@@ -7,7 +7,7 @@
   <link href="https://www.w3.org/StyleSheets/TR/2021/W3C-ED" rel="stylesheet">
   <meta content="Bikeshed version 82ce88815, updated Thu Sep 7 16:33:55 2023 -0700" name="generator">
   <link href="https://www.w3.org/TR/trusted-types/" rel="canonical">
-  <meta content="cf78f7e969f80f66507baa4d70834ebc15fce6c7" name="document-revision">
+  <meta content="1c98273966a4834cee4cdf5a3ccdb2d0b9d2046d" name="document-revision">
 <style>/* Boilerplate: style-autolinks */
 .css.css, .property.property, .descriptor.descriptor {
     color: var(--a-normal-text);
@@ -1005,7 +1005,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1 class="p-name no-ref" id="title">Trusted Types</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-07-04">4 July 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-09-09">9 September 2024</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -1141,7 +1141,6 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
         <li><a href="#does-sink-require-trusted-types"><span class="secno">4.3.3</span> <span class="content"><span>Does sink type require trusted types?</span></span></a>
         <li><a href="#should-block-sink-type-mismatch"><span class="secno">4.3.4</span> <span class="content"><span>Should sink type mismatch violation be blocked by Content Security Policy?</span></span></a>
         <li><a href="#should-block-create-policy"><span class="secno">4.3.5</span> <span class="content"><span>Should Trusted Type policy creation be blocked by Content Security Policy?</span></span></a>
-        <li><a href="#csp-eval"><span class="secno">4.3.6</span> <span class="content">Support for dynamic code compilation</span></a>
        </ol>
      </ol>
     <li>
@@ -1184,7 +1183,6 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
     <summary>Tests</summary>
     <ul class="wpt-tests-list">
      <li class="wpt-test"><a class="wpt-name" href="https://wpt.fyi/results/trusted-types/block-Document-execCommand.html" title="trusted-types/block-Document-execCommand.html">block-Document-execCommand.html</a> <a class="wpt-live" href="http://wpt.live/trusted-types/block-Document-execCommand.html"><small>(live test)</small></a> <a class="wpt-source" href="https://github.com/web-platform-tests/wpt/blob/master/trusted-types/block-Document-execCommand.html"><small>(source)</small></a>
-     <li class="wpt-test"><a class="wpt-name" href="https://wpt.fyi/results/trusted-types/block-Node-multiple-arguments.html" title="trusted-types/block-Node-multiple-arguments.html">block-Node-multiple-arguments.html</a> <a class="wpt-live" href="http://wpt.live/trusted-types/block-Node-multiple-arguments.html"><small>(live test)</small></a> <a class="wpt-source" href="https://github.com/web-platform-tests/wpt/blob/master/trusted-types/block-Node-multiple-arguments.html"><small>(source)</small></a>
      <li class="wpt-test"><a class="wpt-name" href="https://wpt.fyi/results/trusted-types/block-string-assignment-to-attribute-via-attribute-node.html" title="trusted-types/block-string-assignment-to-attribute-via-attribute-node.html">block-string-assignment-to-attribute-via-attribute-node.html</a> <a class="wpt-live" href="http://wpt.live/trusted-types/block-string-assignment-to-attribute-via-attribute-node.html"><small>(live test)</small></a> <a class="wpt-source" href="https://github.com/web-platform-tests/wpt/blob/master/trusted-types/block-string-assignment-to-attribute-via-attribute-node.html"><small>(source)</small></a>
      <li class="wpt-test"><a class="wpt-name" href="https://wpt.fyi/results/trusted-types/block-string-assignment-to-Document-parseHTMLUnsafe.html" title="trusted-types/block-string-assignment-to-Document-parseHTMLUnsafe.html">block-string-assignment-to-Document-parseHTMLUnsafe.html</a> <a class="wpt-live" href="http://wpt.live/trusted-types/block-string-assignment-to-Document-parseHTMLUnsafe.html"><small>(live test)</small></a> <a class="wpt-source" href="https://github.com/web-platform-tests/wpt/blob/master/trusted-types/block-string-assignment-to-Document-parseHTMLUnsafe.html"><small>(source)</small></a>
      <li class="wpt-test"><a class="wpt-name" href="https://wpt.fyi/results/trusted-types/block-string-assignment-to-Document-write.html" title="trusted-types/block-string-assignment-to-Document-write.html">block-string-assignment-to-Document-write.html</a> <a class="wpt-live" href="http://wpt.live/trusted-types/block-string-assignment-to-Document-write.html"><small>(live test)</small></a> <a class="wpt-source" href="https://github.com/web-platform-tests/wpt/blob/master/trusted-types/block-string-assignment-to-Document-write.html"><small>(source)</small></a>
@@ -1828,9 +1826,9 @@ <h4 class="heading settled" data-level="2.3.1" id="trusted-type-policy-factory">
      <dd data-md>
       <p>is a <code class="idl"><a data-link-type="idl" href="#trustedscript" id="ref-for-trustedscript⑦">TrustedScript</a></code> object with its <a data-link-type="dfn" href="#trustedscript-data" id="ref-for-trustedscript-data②">data</a> value set to an empty string.</p>
     </dl>
-    <p class="note" role="note"><span class="marker">Note:</span> This object can be used to detect if the runtime environment has <a href="#csp-eval">§ 4.3.6 Support for dynamic code compilation</a>. While native Trusted Types implementation can
-support <code>eval(TrustedScript)</code>, it is impossible for a polyfill to  emulate that, as
-eval(TrustedScript) will return its input without unwrapping and evaluating the code.</p>
+    <p class="note" role="note"><span class="marker">Note:</span> This object can be used to detect if the runtime environment has support for dynamic code compilation.
+While native Trusted Types implementation can support <code>eval(TrustedScript)</code>, it is impossible for a polyfill to
+emulate that, as eval(TrustedScript) will return its input without unwrapping and evaluating the code.</p>
     <div class="example" id="empty-script-example">
      <a class="self-link" href="#empty-script-example"></a> 
 <pre class="highlight"><c- c1>// With native Trusted Types support eval(trustedTypes.emptyScript) will execute and return falsy undefined.</c->
@@ -2010,15 +2008,11 @@ <h3 class="heading settled" data-level="3.1" id="create-trusted-type-policy-algo
     <li data-md>
      <p>Set <var>policy</var>’s <code>name</code> property value to <var>policyName</var>.</p>
     <li data-md>
-     <p>Let <var>policyOptions</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-trustedtypepolicyoptions" id="ref-for-dictdef-trustedtypepolicyoptions⑤">TrustedTypePolicyOptions</a></code> object.</p>
-    <li data-md>
-     <p>Set <var>policyOptions</var> <code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicy-createhtml" id="ref-for-dom-trustedtypepolicy-createhtml②">createHTML</a></code> property to <var>options</var>’ <code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicyoptions-createhtml" id="ref-for-dom-trustedtypepolicyoptions-createhtml">createHTML</a></code> property value.</p>
-    <li data-md>
-     <p>Set <var>policyOptions</var> <code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicy-createscript" id="ref-for-dom-trustedtypepolicy-createscript②">createScript</a></code> property to <var>options</var>’ <code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicyoptions-createscript" id="ref-for-dom-trustedtypepolicyoptions-createscript">createScript</a></code> property value.</p>
-    <li data-md>
-     <p>Set <var>policyOptions</var> <code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicy-createscripturl" id="ref-for-dom-trustedtypepolicy-createscripturl②">createScriptURL</a></code> property to <var>options</var>’ <code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicyoptions-createscripturl" id="ref-for-dom-trustedtypepolicyoptions-createscripturl">createScriptURL</a></code> property value.</p>
-    <li data-md>
-     <p>Set <var>policy</var>’s <a data-link-type="dfn" href="#trustedtypepolicy-options" id="ref-for-trustedtypepolicy-options">options</a> value to <em>policyOptions</em>.</p>
+     <p>Set <var>policy</var>’s <a data-link-type="dfn" href="#trustedtypepolicy-options" id="ref-for-trustedtypepolicy-options">options</a> value to «[
+  "createHTML" -> <var>options</var>["<code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicyoptions-createhtml" id="ref-for-dom-trustedtypepolicyoptions-createhtml">createHTML</a></code>",
+  "createScript" -> <var>options</var>["<code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicyoptions-createscript" id="ref-for-dom-trustedtypepolicyoptions-createscript">createScript</a></code>",
+  "createScriptURL" -> <var>options</var>["<code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicyoptions-createscripturl" id="ref-for-dom-trustedtypepolicyoptions-createscripturl">createScriptURL</a></code>"
+]».</p>
     <li data-md>
      <p>If the <var>policyName</var> is <code>default</code>, set the <var>factory</var>’s <a data-link-type="dfn" href="#trustedtypepolicyfactory-default-policy" id="ref-for-trustedtypepolicyfactory-default-policy②">default policy</a> value to <var>policy</var>.</p>
     <li data-md>
@@ -2065,7 +2059,7 @@ <h3 class="heading settled" data-level="3.3" id="get-trusted-type-policy-value-a
         <td>"TrustedScriptURL"
      </table>
     <li data-md>
-     <p>Let <var>function</var> be the value of the property in <var>policy</var>’s <a data-link-type="dfn" href="#trustedtypepolicy-options" id="ref-for-trustedtypepolicy-options①">options</a> named <var>functionName</var>.</p>
+     <p>Let <var>function</var> be <var>policy</var>’s <a data-link-type="dfn" href="#trustedtypepolicy-options" id="ref-for-trustedtypepolicy-options①">options</a>[<var>functionName</var>].</p>
     <li data-md>
      <p>If <var>function</var> is <code>null</code>, then:</p>
      <ol>
@@ -2585,8 +2579,6 @@ <h4 class="heading settled" data-level="4.3.5" id="should-block-create-policy"><
     <li data-md>
      <p>Return <var>result</var>.</p>
    </ol>
-   <h4 class="heading settled" data-level="4.3.6" id="csp-eval"><span class="secno">4.3.6. </span><span class="content">Support for dynamic code compilation</span><a class="self-link" href="#csp-eval"></a></h4>
-   <p class="note" role="note"><span class="marker">Note:</span> See <a href="https://github.com/w3c/webappsec-csp/pull/659">https://github.com/w3c/webappsec-csp/pull/659</a> which upstreams this integration.</p>
    <h2 class="heading settled" data-level="5" id="security-considerations"><span class="secno">5. </span><span class="content">Security Considerations</span><a class="self-link" href="#security-considerations"></a></h2>
    <p>Trusted Types are not intended to protect access to <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink②⑦">injection sinks</a> in an
 actively malicious execution environment. It’s assumed that the application is
@@ -3775,10 +3767,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['trustedtypepolicy'] = {"dfnID": "trustedtypepolicy", "url": "#trustedtypepolicy", "dfnText": "TrustedTypePolicy", "refSections": [{"refs": [{"id": "ref-for-trustedtypepolicy"}], "title": "2.2.1. TrustedHTML"}, {"refs": [{"id": "ref-for-trustedtypepolicy\u2460"}], "title": "2.2.2. TrustedScript"}, {"refs": [{"id": "ref-for-trustedtypepolicy\u2461"}], "title": "2.2.3. TrustedScriptURL"}, {"refs": [{"id": "ref-for-trustedtypepolicy\u2462"}, {"id": "ref-for-trustedtypepolicy\u2463"}, {"id": "ref-for-trustedtypepolicy\u2464"}, {"id": "ref-for-trustedtypepolicy\u2465"}, {"id": "ref-for-trustedtypepolicy\u2466"}], "title": "2.3.1. TrustedTypePolicyFactory"}, {"refs": [{"id": "ref-for-trustedtypepolicy\u2467"}], "title": "2.3.2. TrustedTypePolicy"}, {"refs": [{"id": "ref-for-trustedtypepolicy\u2468"}], "title": "2.3.3. TrustedTypePolicyOptions"}, {"refs": [{"id": "ref-for-trustedtypepolicy\u2460\u24ea"}, {"id": "ref-for-trustedtypepolicy\u2460\u2460"}], "title": "3.1. Create a Trusted Type Policy"}, {"refs": [{"id": "ref-for-trustedtypepolicy\u2460\u2461"}], "title": "3.2. Create a Trusted Type"}, {"refs": [{"id": "ref-for-trustedtypepolicy\u2460\u2462"}], "title": "3.3. Get Trusted Type policy value"}, {"refs": [{"id": "ref-for-trustedtypepolicy\u2460\u2463"}], "title": "4.3.5. Should Trusted Type policy creation be blocked by Content Security Policy?"}], "external": false};
 window.dfnpanelData['trustedtypepolicy-name'] = {"dfnID": "trustedtypepolicy-name", "url": "#trustedtypepolicy-name", "dfnText": "name", "refSections": [{"refs": [{"id": "ref-for-trustedtypepolicy-name"}], "title": "2.3.4. Default policy"}], "external": false};
 window.dfnpanelData['trustedtypepolicy-options'] = {"dfnID": "trustedtypepolicy-options", "url": "#trustedtypepolicy-options", "dfnText": "options", "refSections": [{"refs": [{"id": "ref-for-trustedtypepolicy-options"}], "title": "3.1. Create a Trusted Type Policy"}, {"refs": [{"id": "ref-for-trustedtypepolicy-options\u2460"}], "title": "3.3. Get Trusted Type policy value"}], "external": false};
-window.dfnpanelData['dom-trustedtypepolicy-createhtml'] = {"dfnID": "dom-trustedtypepolicy-createhtml", "url": "#dom-trustedtypepolicy-createhtml", "dfnText": "createHTML(input, ...arguments)", "refSections": [{"refs": [{"id": "ref-for-dom-trustedtypepolicy-createhtml"}], "title": "2.2.1. TrustedHTML"}, {"refs": [{"id": "ref-for-dom-trustedtypepolicy-createhtml\u2460"}], "title": "2.3.2. TrustedTypePolicy"}, {"refs": [{"id": "ref-for-dom-trustedtypepolicy-createhtml\u2461"}], "title": "3.1. Create a Trusted Type Policy"}], "external": false};
-window.dfnpanelData['dom-trustedtypepolicy-createscript'] = {"dfnID": "dom-trustedtypepolicy-createscript", "url": "#dom-trustedtypepolicy-createscript", "dfnText": "createScript(input, ...arguments)", "refSections": [{"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscript"}], "title": "2.2.2. TrustedScript"}, {"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscript\u2460"}], "title": "2.3.2. TrustedTypePolicy"}, {"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscript\u2461"}], "title": "3.1. Create a Trusted Type Policy"}], "external": false};
-window.dfnpanelData['dom-trustedtypepolicy-createscripturl'] = {"dfnID": "dom-trustedtypepolicy-createscripturl", "url": "#dom-trustedtypepolicy-createscripturl", "dfnText": "createScriptURL(input, ...arguments)", "refSections": [{"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscripturl"}], "title": "2.2.3. TrustedScriptURL"}, {"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscripturl\u2460"}], "title": "2.3.2. TrustedTypePolicy"}, {"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscripturl\u2461"}], "title": "3.1. Create a Trusted Type Policy"}], "external": false};
-window.dfnpanelData['dictdef-trustedtypepolicyoptions'] = {"dfnID": "dictdef-trustedtypepolicyoptions", "url": "#dictdef-trustedtypepolicyoptions", "dfnText": "TrustedTypePolicyOptions", "refSections": [{"refs": [{"id": "ref-for-dictdef-trustedtypepolicyoptions"}, {"id": "ref-for-dictdef-trustedtypepolicyoptions\u2460"}], "title": "2.3.1. TrustedTypePolicyFactory"}, {"refs": [{"id": "ref-for-dictdef-trustedtypepolicyoptions\u2461"}], "title": "2.3.2. TrustedTypePolicy"}, {"refs": [{"id": "ref-for-dictdef-trustedtypepolicyoptions\u2462"}], "title": "2.3.3. TrustedTypePolicyOptions"}, {"refs": [{"id": "ref-for-dictdef-trustedtypepolicyoptions\u2463"}, {"id": "ref-for-dictdef-trustedtypepolicyoptions\u2464"}], "title": "3.1. Create a Trusted Type Policy"}], "external": false};
+window.dfnpanelData['dom-trustedtypepolicy-createhtml'] = {"dfnID": "dom-trustedtypepolicy-createhtml", "url": "#dom-trustedtypepolicy-createhtml", "dfnText": "createHTML(input, ...arguments)", "refSections": [{"refs": [{"id": "ref-for-dom-trustedtypepolicy-createhtml"}], "title": "2.2.1. TrustedHTML"}, {"refs": [{"id": "ref-for-dom-trustedtypepolicy-createhtml\u2460"}], "title": "2.3.2. TrustedTypePolicy"}], "external": false};
+window.dfnpanelData['dom-trustedtypepolicy-createscript'] = {"dfnID": "dom-trustedtypepolicy-createscript", "url": "#dom-trustedtypepolicy-createscript", "dfnText": "createScript(input, ...arguments)", "refSections": [{"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscript"}], "title": "2.2.2. TrustedScript"}, {"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscript\u2460"}], "title": "2.3.2. TrustedTypePolicy"}], "external": false};
+window.dfnpanelData['dom-trustedtypepolicy-createscripturl'] = {"dfnID": "dom-trustedtypepolicy-createscripturl", "url": "#dom-trustedtypepolicy-createscripturl", "dfnText": "createScriptURL(input, ...arguments)", "refSections": [{"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscripturl"}], "title": "2.2.3. TrustedScriptURL"}, {"refs": [{"id": "ref-for-dom-trustedtypepolicy-createscripturl\u2460"}], "title": "2.3.2. TrustedTypePolicy"}], "external": false};
+window.dfnpanelData['dictdef-trustedtypepolicyoptions'] = {"dfnID": "dictdef-trustedtypepolicyoptions", "url": "#dictdef-trustedtypepolicyoptions", "dfnText": "TrustedTypePolicyOptions", "refSections": [{"refs": [{"id": "ref-for-dictdef-trustedtypepolicyoptions"}, {"id": "ref-for-dictdef-trustedtypepolicyoptions\u2460"}], "title": "2.3.1. TrustedTypePolicyFactory"}, {"refs": [{"id": "ref-for-dictdef-trustedtypepolicyoptions\u2461"}], "title": "2.3.2. TrustedTypePolicy"}, {"refs": [{"id": "ref-for-dictdef-trustedtypepolicyoptions\u2462"}], "title": "2.3.3. TrustedTypePolicyOptions"}, {"refs": [{"id": "ref-for-dictdef-trustedtypepolicyoptions\u2463"}], "title": "3.1. Create a Trusted Type Policy"}], "external": false};
 window.dfnpanelData['dom-trustedtypepolicyoptions-createhtml'] = {"dfnID": "dom-trustedtypepolicyoptions-createhtml", "url": "#dom-trustedtypepolicyoptions-createhtml", "dfnText": "createHTML", "refSections": [{"refs": [{"id": "ref-for-dom-trustedtypepolicyoptions-createhtml"}], "title": "3.1. Create a Trusted Type Policy"}], "external": false};
 window.dfnpanelData['dom-trustedtypepolicyoptions-createscript'] = {"dfnID": "dom-trustedtypepolicyoptions-createscript", "url": "#dom-trustedtypepolicyoptions-createscript", "dfnText": "createScript", "refSections": [{"refs": [{"id": "ref-for-dom-trustedtypepolicyoptions-createscript"}], "title": "3.1. Create a Trusted Type Policy"}], "external": false};
 window.dfnpanelData['dom-trustedtypepolicyoptions-createscripturl'] = {"dfnID": "dom-trustedtypepolicyoptions-createscripturl", "url": "#dom-trustedtypepolicyoptions-createscripturl", "dfnText": "createScriptURL", "refSections": [{"refs": [{"id": "ref-for-dom-trustedtypepolicyoptions-createscripturl"}], "title": "3.1. Create a Trusted Type Policy"}], "external": false};