Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test TT is not enforced when taking an element out of a TT realm to a… #46432

Closed
wants to merge 1 commit into from
Closed

Test TT is not enforced when taking an element out of a TT realm to a… #46432

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 80 additions & 0 deletions trusted-types/Element-setAttribute-not-enforced-in-non-TT-documents-globals-CSP.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Once the relevant spec PR (whatwg/dom#1268) is merged, the relevant spec should be linked here via <link rel="help" href="<linkToSpec>">.

</head>
<body>
<script>
const iframePolicy = trustedTypes.createPolicy("iframePolicy", {
createHTML: (s) => s,
});

const iframe_srcdoc = `
<!DOCTYPE html>
<head>
<meta charset="utf-8">
<meta
http-equiv="Content-Security-Policy"
content="require-trusted-types-for 'script';"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The semicolon at the end is superfluous.

/>
</head>
<body>
<div id="nonSVGTestElements">
<iframe id="iframe.srcdoc" srcdoc="v"></iframe>
<script id="script.src" src="v"><\/script>
</div>
<svg id="svgTestElements">
<script id="script.href" href="v"><\/script>
<script id="script.xlinkhref" xlink:href="v"><\/script>
</svg>
</body>`;

const testCases = [
['iframe', 'srcdoc'],
['script', 'src'],
['script', 'href'],
['script', 'xlinkhref'],
];

const sourceFrame = document.createElement("iframe");
sourceFrame.srcdoc = iframePolicy.createHTML(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sourceFrame, at the time of assigning has no CSP, hence wrapping iframe_srcdoc in a TrustedHTML object is superfluous. Please remove that.

iframe_srcdoc
);
document.body.append(sourceFrame);

async_test(
(t) => {
t.add_cleanup(() => {
sourceFrame.remove();
});

sourceFrame.addEventListener(
"load",
t.step_func_done(() => {
testCases.forEach(c => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Running all test cases in one step_func_done results in a test suite which is hard to debug. Consider changing this file to run one async_test or promise_test for every element of testCases.

const elementId = c[0].concat('.').concat(c[1]);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit-picking: c.join(".") would be more concise.

const sourceElement = sourceFrame.contentWindow.document.getElementById(elementId);
const testAttr = sourceElement.attributes[1];
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The order of .attribute's values my differ among browsers, see https://developer.mozilla.org/en-US/docs/Web/API/Element/attributes.

const sourceAttr = sourceElement.getAttributeNode(
testAttr.name
);
sourceElement.removeAttributeNode(sourceAttr);
// Now `sourceElement`'s node document's global belongs to a non TT-realm.
Copy link
Contributor

@mbrodesser-Igalia mbrodesser-Igalia Dec 10, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment is false at that line. It should be true after appending to document.body, be moved there and rephrased to something like:

"Now sourceElement's node document's global should belong to a non TT-realm. Hence setAttributeNode and setAttributeNS with non-trusted input should pass".

document.body.append(sourceElement);
sourceElement.setAttributeNode(sourceAttr);
sourceElement.setAttributeNS(sourceAttr.namespaceURI, sourceAttr.name, sourceAttr.value);
let attr_name = sourceAttr.name;
if (elementId == "script.xlinkhref") {
attr_name = "href";
}
let attr_node = sourceElement.getAttributeNodeNS(sourceAttr.namespaceURI, attr_name);
assert_equals(attr_node.value + "", "v");
});
})
);
}, `setAttribute and setAttributeNode are no longer enforced while being taken out to a non-TT realm.`);
</script>
</body>
</html>