From 784f70db5d4d58345b7ed2188ca408719ffbe405 Mon Sep 17 00:00:00 2001 From: Frederik Braun Date: Mon, 11 Dec 2023 10:01:25 +0100 Subject: [PATCH 1/2] Update standards position on Trusted Types - fixes #20 --- activities.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/activities.json b/activities.json index cbe706c..fa2141c 100644 --- a/activities.json +++ b/activities.json @@ -1573,8 +1573,8 @@ "description": "An API that allows applications to lock down powerful APIs to only accept non-spoofable, typed values in place of strings to prevent vulnerabilities caused by using these APIs with attacker-controlled inputs.", "id": "trusted-types", "mozBugUrl": null, - "mozPosition": "neutral", - "mozPositionDetail": "The API could be used to harden sites against certain cross-site scripting issues, but it is sufficiently complex that we are concerned that it will not be suitable for many sites.", + "mozPosition": "positive", + "mozPositionDetail": "Mozilla believes that preventing DOM-based XSS is an important security goal. The track record of preventing DOM-based XSS is convincing. That being said, the Trusted Types specification is also providing API methods with little or unknown value and uptake, like getPropertyType, getAttributeType. Additionally, there are features in the Chrome implementations that are not yet standardized, like the beforepolicycreation event. These should ideally be properly standardized (based on a proven need) or deprecated and removed. Dealing with inscrutable third-party dependencies or external JavaScript has been a major concern of security and enforcing reasonable boundaries is a promising approach. We believe that runtime checking of untrusted HTML might pair well with a Sanitizer API that should be complementary.", "mozPositionIssue": 20, "org": "W3C", "title": "Trusted Types", From 423bb49268be550ae30fe2b945f3ebdf9845c0f2 Mon Sep 17 00:00:00 2001 From: Frederik Braun Date: Wed, 13 Dec 2023 08:50:10 +0100 Subject: [PATCH 2/2] Update activities.json Co-authored-by: Martin Thomson --- activities.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/activities.json b/activities.json index fa2141c..708acfd 100644 --- a/activities.json +++ b/activities.json @@ -1574,7 +1574,7 @@ "id": "trusted-types", "mozBugUrl": null, "mozPosition": "positive", - "mozPositionDetail": "Mozilla believes that preventing DOM-based XSS is an important security goal. The track record of preventing DOM-based XSS is convincing. That being said, the Trusted Types specification is also providing API methods with little or unknown value and uptake, like getPropertyType, getAttributeType. Additionally, there are features in the Chrome implementations that are not yet standardized, like the beforepolicycreation event. These should ideally be properly standardized (based on a proven need) or deprecated and removed. Dealing with inscrutable third-party dependencies or external JavaScript has been a major concern of security and enforcing reasonable boundaries is a promising approach. We believe that runtime checking of untrusted HTML might pair well with a Sanitizer API that should be complementary.", + "mozPositionDetail": "Mozilla believes that preventing DOM-based XSS is an important security goal. The track record of preventing DOM-based XSS is convincing. Dealing with inscrutable third-party dependencies or external JavaScript has been a major concern of security and enforcing reasonable boundaries is a promising approach. We have some reservations about some features in the Chromium implementation, which need to be validated and standardized or removed.", "mozPositionIssue": 20, "org": "W3C", "title": "Trusted Types",