From 3bd4d23a3512dd10116a5d413a1b8a2b4113db4b Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Wed, 31 Jan 2024 15:13:34 +0100 Subject: [PATCH 01/10] Add test for importing a `srcdoc` attribute node from a non-TT realm to a TT iframe element throws First step to fix . Will add separate commits for the other tests requested at above ticket. --- ...ng-assignment-to-Element-setAttribute.html | 19 +++++++++++++++++++ ...ut-trusted-types-and-srcdoc-attribute.html | 5 +++++ 2 files changed, 24 insertions(+) create mode 100644 trusted-types/support/document-without-trusted-types-and-srcdoc-attribute.html diff --git a/trusted-types/block-string-assignment-to-Element-setAttribute.html b/trusted-types/block-string-assignment-to-Element-setAttribute.html index 295890f319a482..e2421e4c8d18a9 100644 --- a/trusted-types/block-string-assignment-to-Element-setAttribute.html +++ b/trusted-types/block-string-assignment-to-Element-setAttribute.html @@ -8,6 +8,7 @@ + diff --git a/trusted-types/support/document-without-trusted-types-and-srcdoc-attribute.html b/trusted-types/support/document-without-trusted-types-and-srcdoc-attribute.html new file mode 100644 index 00000000000000..ab453d3094fd9a --- /dev/null +++ b/trusted-types/support/document-without-trusted-types-and-srcdoc-attribute.html @@ -0,0 +1,5 @@ + + + + +
doc without TT From d120fc843fae3f026ca2f0ed271967da21407a23 Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Thu, 1 Feb 2024 10:44:09 +0100 Subject: [PATCH 02/10] Schedule the new test before a default policy is created and simplify the new test --- ...ng-assignment-to-Element-setAttribute.html | 50 +++++++++++-------- ...ut-trusted-types-and-srcdoc-attribute.html | 5 -- 2 files changed, 30 insertions(+), 25 deletions(-) delete mode 100644 trusted-types/support/document-without-trusted-types-and-srcdoc-attribute.html diff --git a/trusted-types/block-string-assignment-to-Element-setAttribute.html b/trusted-types/block-string-assignment-to-Element-setAttribute.html index e2421e4c8d18a9..4a78ab33a77746 100644 --- a/trusted-types/block-string-assignment-to-Element-setAttribute.html +++ b/trusted-types/block-string-assignment-to-Element-setAttribute.html @@ -8,9 +8,9 @@ - diff --git a/trusted-types/support/document-without-trusted-types-and-srcdoc-attribute.html b/trusted-types/support/document-without-trusted-types-and-srcdoc-attribute.html deleted file mode 100644 index ab453d3094fd9a..00000000000000 --- a/trusted-types/support/document-without-trusted-types-and-srcdoc-attribute.html +++ /dev/null @@ -1,5 +0,0 @@ - - - - -
doc without TT From 2c2ea1996a6d759ed20a3aa1c8d795dc7cf22552 Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Thu, 1 Feb 2024 12:30:08 +0100 Subject: [PATCH 03/10] Move test to and further simplify it --- ...ng-assignment-to-Element-setAttribute.html | 31 +------------- ...ssignment-to-Element-setAttributeNode.html | 42 +++++++++++++++++++ 2 files changed, 43 insertions(+), 30 deletions(-) create mode 100644 trusted-types/block-string-assignment-to-Element-setAttributeNode.html diff --git a/trusted-types/block-string-assignment-to-Element-setAttribute.html b/trusted-types/block-string-assignment-to-Element-setAttribute.html index 4a78ab33a77746..295890f319a482 100644 --- a/trusted-types/block-string-assignment-to-Element-setAttribute.html +++ b/trusted-types/block-string-assignment-to-Element-setAttribute.html @@ -9,8 +9,7 @@ + + + + + + From aeed729ca7b4416c2174c8a1a9744c8182c40c13 Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Thu, 1 Feb 2024 12:49:12 +0100 Subject: [PATCH 04/10] Add TODO --- .../block-string-assignment-to-Element-setAttributeNode.html | 3 +++ 1 file changed, 3 insertions(+) diff --git a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html b/trusted-types/block-string-assignment-to-Element-setAttributeNode.html index d22e0ba56a04c6..cfdb8620ad9027 100644 --- a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html +++ b/trusted-types/block-string-assignment-to-Element-setAttributeNode.html @@ -11,6 +11,9 @@ +
+ + + + + +
+ + + + From 4a9e49c9332ff4bcfecfeddfbf8003256655b2e7 Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Tue, 20 Feb 2024 10:26:16 +0100 Subject: [PATCH 06/10] Change test to check `aTestElement`'s `ownerDocument` equals `document` --- .../block-string-assignment-to-Element-setAttributeNode.html | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html b/trusted-types/block-string-assignment-to-Element-setAttributeNode.html index 14d8ef886ee89b..02ae925a4999ec 100644 --- a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html +++ b/trusted-types/block-string-assignment-to-Element-setAttributeNode.html @@ -45,8 +45,7 @@ // A window is a global object which has 1-to-1 mapping to a realm, see the first // note of // and its following paragraph. - assert_not_equals(aTestElement.ownerDocument, null); - assert_not_equals(aTestElement.ownerDocument, undefined); + assert_equals(aTestElement.ownerDocument, document); assert_not_equals(aTestElement.ownerDocument.defaultView, sourceFrame.contentWindow, "The source frame's realm differs from the test element's realm."); From d6151692c00e8d531a6d24771861603c9c10f59e Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Wed, 21 Feb 2024 10:51:32 +0100 Subject: [PATCH 07/10] Refactor test to use the XLink namespace for SVG's script element --- ...ing-assignment-to-Element-setAttributeNode.html | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html b/trusted-types/block-string-assignment-to-Element-setAttributeNode.html index 02ae925a4999ec..d10b5d765ae891 100644 --- a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html +++ b/trusted-types/block-string-assignment-to-Element-setAttributeNode.html @@ -28,12 +28,18 @@ async_test(t => { const sourceFrame = document.createElement("iframe"); + // The markup requires the parent element to ensure the attribute is associated with the + // correct namespace. sourceFrame.srcdoc = passThroughPolicy.createHTML( ` -
+ + <` + aTestElement.parentElement.localName + `> + <` + aTestElement.localName + ` ` + testAttr.name + `="` + testAttr.value + `"> + + doc without TT CSP. `); @@ -49,9 +55,9 @@ assert_not_equals(aTestElement.ownerDocument.defaultView, sourceFrame.contentWindow, "The source frame's realm differs from the test element's realm."); - const div = sourceFrame.contentDocument.body.querySelector("div"); - const sourceAttr = div.getAttributeNode(testAttr.name); - div.removeAttributeNode(sourceAttr); + const sourceElement = sourceFrame.contentDocument.body.querySelector(aTestElement.localName); + const sourceAttr = sourceElement.getAttributeNode(testAttr.name); + sourceElement.removeAttributeNode(sourceAttr); assert_throws_js(TypeError, () => { aTestElement.setAttributeNode(sourceAttr); }); })); From 26c25f948093d3979655568df7f7fe39f6b8a9c7 Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Thu, 22 Feb 2024 10:18:38 +0100 Subject: [PATCH 08/10] Remove unnecessary assertions and explain in a comment that `aTestElement`'s and `sourceAttr`s realms differ --- ...block-string-assignment-to-Element-setAttributeNode.html | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html b/trusted-types/block-string-assignment-to-Element-setAttributeNode.html index d10b5d765ae891..00bd68985768bf 100644 --- a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html +++ b/trusted-types/block-string-assignment-to-Element-setAttributeNode.html @@ -50,10 +50,8 @@ sourceFrame.addEventListener("load", t.step_func_done(() => { // A window is a global object which has 1-to-1 mapping to a realm, see the first // note of - // and its following paragraph. - assert_equals(aTestElement.ownerDocument, document); - assert_not_equals(aTestElement.ownerDocument.defaultView, sourceFrame.contentWindow, - "The source frame's realm differs from the test element's realm."); + // and its following paragraph. Here, `aTestElement`'s and `sourceAttr`'s windows + // differ, hence they belong to different realms. const sourceElement = sourceFrame.contentDocument.body.querySelector(aTestElement.localName); const sourceAttr = sourceElement.getAttributeNode(testAttr.name); From b617318b3ef38c99c60bec01923f330a8138f75a Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Thu, 28 Mar 2024 10:12:33 +0100 Subject: [PATCH 09/10] Change test to check `setAttributeNode` and `setAttribute` respect the element's node document's global's CSP Requires https://github.com/web-platform-tests/wpt/issues/45405 to be fixed. --- ...s-Elements-node-documents-globals-CSP.html | 125 ++++++++++++++++++ ...ssignment-to-Element-setAttributeNode.html | 79 ----------- 2 files changed, 125 insertions(+), 79 deletions(-) create mode 100644 trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP.html delete mode 100644 trusted-types/block-string-assignment-to-Element-setAttributeNode.html diff --git a/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP.html b/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP.html new file mode 100644 index 00000000000000..a617865bfdc981 --- /dev/null +++ b/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP.html @@ -0,0 +1,125 @@ + + + + + + + trusted-types (TT): `setAttribute`/`setAttributeNode` for an element + adopted from a non-TT realm respects TT's Content-Security-Policy (CSP) + + + + + +
+ + + + + +
+ + + + + + + diff --git a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html b/trusted-types/block-string-assignment-to-Element-setAttributeNode.html deleted file mode 100644 index 00bd68985768bf..00000000000000 --- a/trusted-types/block-string-assignment-to-Element-setAttributeNode.html +++ /dev/null @@ -1,79 +0,0 @@ - - - - - -trusted-types (TT): setAttributeNode with node from non-TT realm - - - - -
- - - - - -
- - - - - - - From dfd95a9bed40d480fa894c479a2b24308bda489c Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Mon, 8 Apr 2024 11:44:27 +0200 Subject: [PATCH 10/10] Use `sourceFrame.contentWindow`'s `TyperError` constructor --- ...ttribute-respects-Elements-node-documents-globals-CSP.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP.html b/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP.html index a617865bfdc981..c0f72bb36ac09c 100644 --- a/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP.html +++ b/trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP.html @@ -89,10 +89,10 @@ document.body.append(sourceElement); // Now `sourceElement`'s node document's global belongs to a TT-realm. - assert_throws_js(TypeError, () => { + assert_throws_js(sourceFrame.contentWindow.TypeError, () => { sourceElement.setAttributeNode(sourceAttr); }); - assert_throws_js(TypeError, () => { + assert_throws_js(sourceFrame.contentWindow.TypeError, () => { sourceElement.setAttributeNS( sourceAttr.namespaceURI, sourceAttr.name,