Trusted Types - FF updates and missing entries in TT spec #25839

hamishwillee · 2025-02-03T05:05:29Z

FF has added more support for trusted types behind a flag. This adds those updates.

Also it adds some missing entries, primarily for the methods and properties that will now accept trusted types. Some of this is a bit weird so I've added comments inline explaining how/why I did stuff.

FF135 The Document.write() and writeln() accept {{domxref("TrustedHTML")}} objects as parameters, in addition to strings. https://bugzilla.mozilla.org/show_bug.cgi?id=1906301 - I tested version support for Chrome using https://wpt.live/trusted-types/Document-write.html
The HTMLScriptElement.text, innerText, and textContent properties now accept TrustedScript as a setter, while HTMLScriptElement.src accepts TrustedScriptURL in https://bugzilla.mozilla.org/show_bug.cgi?id=1905706
- Note, the innerText and textContext were formerly inherited from HTMLElement and Node respectively.
FF135 supports setTimeout and setInterval taking a trustedtype - as a proxy for code in a script. But it isn't in the spec other than broadly referred to. I have added info though, because it is a compat issue - it should be listed in https://w3c.github.io/trusted-types/dist/spec/#dom-xss-injection-sinks
FF supports the global trustedTypes - you need to have that for anything to work. I have added this as though added in FF135. It might have appeared earlier, but not useful - I'm OK with it since all of that will change when this gets released.
Element.innerHTML and the shadow versions arent speced with alternative IDL saying it can take a trusted type, but there are examples which show that, and wpt tests, and they are mentioned in https://w3c.github.io/trusted-types/dist/spec/#dom-xss-injection-sinks - which I have used for the spec url.

The spec mentions some other cases such as Element.outerHTML setters, and functions that create a new same-origin Document with caller-controlled markup like parseFromString(). Have not added that, because I haven't tested it.

hamishwillee · 2025-02-03T05:08:33Z

api/Document.json

+            "status": {
+              "experimental": false,
+              "standard_track": true,
+              "deprecated": true


Note, this is set as not experimental and deprecated, because the parent is deprecated (and you can't have both set).

hamishwillee · 2025-02-03T05:10:56Z

api/HTMLScriptElement.json

@@ -417,6 +417,53 @@
          }
        }
      },
+      "innerText": {


So for this one (and textContent), the properties were around since forever, but inherited. Since this update only applies to the HTMLScriptElement I have added it here as though it were a new property.

Is this OK? I mean it looks like you can only access this from current version, which might be confusing to readers.

I think this will be confusing, yes, because innerText is also defined and BCD-ified in the parent HTMLElement: https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement#browser_compatibility.

And the innerText page takes its BCD from there: https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/innerText#browser_compatibility so this change won't even show up in that page.

Maybe instead of this, add a subfeature to HTMLElement.innerText, like: "Script elements can accept a TrustedScript"? Then it will show up as a subfeature in https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/innerText#browser_compatibility .

It depends on how important strict following of IDL is for BCD. I like the idea though - changed in df3f74f

api/HTMLScriptElement.json

api/_globals/setInterval.json

hamishwillee · 2025-02-03T06:12:37Z

api/_globals/trustedTypes.json

@@ -14,7 +14,14 @@
          "chrome_android": "mirror",
          "edge": "mirror",
          "firefox": {
-            "version_added": false,
+            "version_added": "135",


Not 100% sure when this became useful. The whole API was added behind pref in 125 and no implementation. I've put 135 because it does not harm and we're starting to get where tests can be useful.

hamishwillee · 2025-02-03T06:28:09Z

api/Element.json

@@ -6263,6 +6263,53 @@
            "standard_track": true,
            "deprecated": false
          }
+        },
+        "accepts_TrustedHtml": {


As for other cases, you can set the property with this, but if you were to get it back you'd get a string.

Interesting, I wonder if there would be any desire to formalize BCD subfeatures for property getters and setters.

That would be good. For now I have tried to be consistent.

wbamberg

@Elchi3 asked me for a "domain review" of this PR :).

wbamberg · 2025-02-05T17:59:26Z

api/Document.json

+        },
+        "text_param_accepts_TrustedHTML": {
+          "__compat": {
+            "description": "`text` parameter accepts `TrustedHTML` type",


The page calls the parameter markup so this will be confusing. Also IDK if anyone cares but I think strictly, the parameter doesn't "accept" anything - it is the function that accepts things. The parameter just is something.

Since this method only accepts one parameter we might not have to name the parameter and say "Accepts a TrustedHTML instance" or something like that.

Yes, changed to:

"accepts_TrustedHTML": { "__compat": { "description": "Accepts `TrustedHTML` instances",

This takes an arbitrary number of either/both strings or trusted HTML instances.

FYI I also changed this in my docs PR to text, but will revert, as markup is a better term.

api/Document.json

wbamberg · 2025-02-05T18:01:25Z

api/Element.json

@@ -6263,6 +6263,53 @@
            "standard_track": true,
            "deprecated": false
          }
+        },
+        "accepts_TrustedHtml": {


Interesting, I wonder if there would be any desire to formalize BCD subfeatures for property getters and setters.

wbamberg · 2025-02-05T18:07:17Z

api/HTMLScriptElement.json

@@ -417,6 +417,53 @@
          }
        }
      },
+      "innerText": {


I think this will be confusing, yes, because innerText is also defined and BCD-ified in the parent HTMLElement: https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement#browser_compatibility.

And the innerText page takes its BCD from there: https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/innerText#browser_compatibility so this change won't even show up in that page.

Maybe instead of this, add a subfeature to HTMLElement.innerText, like: "Script elements can accept a TrustedScript"? Then it will show up as a subfeature in https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/innerText#browser_compatibility .

api/HTMLScriptElement.json

api/ShadowRoot.json

api/_globals/setInterval.json

hamishwillee · 2025-02-06T23:44:14Z

api/Document.json

+        "accepts_TrustedHTML": {
+          "__compat": {
+            "description": "Accepts `TrustedHTML` instances",


@wbamberg FWIW I think technically the right way to do this according to the schema is as shown, noting that markup will be used in the docs.

Suggested change

"accepts_TrustedHTML": {

"__compat": {

"description": "Accepts `TrustedHTML` instances",

"markup_param_accepts_TrustedHTML": {

"__compat": {

"description": "Accepts `TrustedHTML` instances",

But as you say, these take just one parameter so it doesn't matter (actually they take multiple parameters of string and/or TrustedHTML, represented as ...text in the spec).

Agree that as these only support a single parameter, there is no need to over-complicate this.

api/Element.json

api/HTMLScriptElement.json

api/ShadowRoot.json

api/Element.json

hamishwillee · 2025-02-07T00:30:10Z

@wbamberg Thanks. Accepted all your suggestions - ready for another look

caugner · 2025-02-07T13:30:14Z

api/Document.json

+        "accepts_TrustedHTML": {
+          "__compat": {
+            "description": "Accepts `TrustedHTML` instances",


Agree that as these only support a single parameter, there is no need to over-complicate this.

caugner · 2025-02-07T13:30:56Z

api/Document.json

+        "accepts_TrustedHTML": {
+          "__compat": {
+            "description": "Accepts `TrustedHTML` instances",
+            "mdn_url": "https://developer.mozilla.org/docs/Web/API/Document/write",


Let's only add mdn_url if it describes this feature (here: accepting TrustedHTML).

Suggested change

"mdn_url": "https://developer.mozilla.org/docs/Web/API/Document/write",

caugner · 2025-02-07T13:33:35Z

api/Document.json

+          "__compat": {
+            "description": "Accepts `TrustedHTML` instances",
+            "mdn_url": "https://developer.mozilla.org/docs/Web/API/Document/write",
+            "spec_url": "https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-document-write",


Let's link closer to where TrustedHTML is actually mentioned:

Suggested change

"spec_url": "https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-document-write",

"spec_url": [

"https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#document-write-steps",

"https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#:~:text=if%20value%20is%20a%20trustedhtml%20object"

],

caugner · 2025-02-07T13:35:20Z

api/Document.json

+            "mdn_url": "https://developer.mozilla.org/docs/Web/API/Document/writeln",
+            "spec_url": "https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-document-writeln",


dito (see above)

caugner · 2025-02-07T13:40:18Z

api/Document.json

+            ],
+            "support": {
+              "chrome": {
+                "version_added": "83"


The mentioned WPT tests (https://wpt.live/trusted-types/Document-write.html) fail for me in Chrome 83 on BrowserStack Live, and only pass from Chrome 86.

Suggested change

"version_added": "83"

"version_added": "86"

caugner · 2025-02-07T13:43:32Z

api/Document.json

+            ],
+            "support": {
+              "chrome": {
+                "version_added": "83"


caugner · 2025-02-07T13:45:03Z

api/_globals/setInterval.json

+      "code_param_accepts_trustedScript": {
+        "__compat": {
+          "description": "`code` parameter can be set with a `TrustedScript` instance",
+          "mdn_url": "https://developer.mozilla.org/docs/Web/API/Window/setInterval",


Suggested change

"mdn_url": "https://developer.mozilla.org/docs/Web/API/Window/setInterval",

caugner · 2025-02-07T13:45:17Z

api/_globals/setTimeout.json

+      "code_param_accepts_trustedScript": {
+        "__compat": {
+          "description": "`code` parameter can be set with a `TrustedScript` instance",
+          "mdn_url": "https://developer.mozilla.org/docs/Web/API/Window/setTimeout",


Suggested change

"mdn_url": "https://developer.mozilla.org/docs/Web/API/Window/setTimeout",

etc

hamishwillee added 5 commits February 3, 2025 14:10

Document.writeln() accepts trusted types

c305f2b

Document.writeln() and write() accepts trusted types

a460c0e

HTMLScriptElement.text accepts TrustedScript

753351c

HTMLScriptElement.src accepts TrustedScriptUrl

1c70fb3

HTMLScriptElement.innerText and .textContent accepts TrustedScript

8ede9b5

github-actions bot added data:api Compat data for Web APIs. https://developer.mozilla.org/docs/Web/API size:l [PR only] 101-1000 LoC changed labels Feb 3, 2025

Doc.write() undeprecate

d125e75

hamishwillee commented Feb 3, 2025

View reviewed changes

api/HTMLScriptElement.json Outdated Show resolved Hide resolved

setInterval and setTimeout take TrustedScript

620805b

hamishwillee commented Feb 3, 2025

View reviewed changes

api/_globals/setInterval.json Outdated Show resolved Hide resolved

hamishwillee added 2 commits February 3, 2025 17:07

global.trustedTypes - FF135

348b9ab

Experimental not false for any of this

16949d1

hamishwillee commented Feb 3, 2025

View reviewed changes

hamishwillee marked this pull request as ready for review February 3, 2025 06:16

hamishwillee added 2 commits February 3, 2025 17:24

Spec url for timers

64b1f2b

Element.innerHTML and ShadowRoot.innerHTML take trustedTypes

12e83bc

hamishwillee commented Feb 3, 2025

View reviewed changes

hamishwillee mentioned this pull request Feb 3, 2025

[WebAPI] Implement Trusted Types support for document.write()/document.writeln() mdn/content#37518

Open

11 tasks

wbamberg reviewed Feb 5, 2025

View reviewed changes

write/writeln to Accepts TrustedHTML instances

e3e7bb5

hamishwillee commented Feb 6, 2025

View reviewed changes

api/Element.json Outdated Show resolved Hide resolved

hamishwillee commented Feb 6, 2025

View reviewed changes

api/HTMLScriptElement.json Outdated Show resolved Hide resolved

hamishwillee commented Feb 6, 2025

View reviewed changes

api/ShadowRoot.json Outdated Show resolved Hide resolved

hamishwillee commented Feb 6, 2025

View reviewed changes

api/Element.json Outdated Show resolved Hide resolved

hamishwillee added 2 commits February 7, 2025 10:53

consistency "set with a XXX instance"

46fe354

Move innerText feature from script element to html element

df3f74f

hamishwillee added 2 commits February 7, 2025 11:16

Move textContent feature from script element to node

2851193

SetInterval/setTimeout fixes

5a9fbb3

hamishwillee requested a review from wbamberg February 7, 2025 00:29

caugner reviewed Feb 7, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Trusted Types - FF updates and missing entries in TT spec #25839

Trusted Types - FF updates and missing entries in TT spec #25839

hamishwillee commented Feb 3, 2025 •

edited

Loading

hamishwillee Feb 3, 2025

hamishwillee Feb 3, 2025

wbamberg Feb 5, 2025

hamishwillee Feb 7, 2025

hamishwillee Feb 3, 2025

hamishwillee Feb 3, 2025

wbamberg Feb 5, 2025

hamishwillee Feb 6, 2025

wbamberg left a comment

wbamberg Feb 5, 2025 •

edited

Loading

hamishwillee Feb 6, 2025 •

edited

Loading

wbamberg Feb 5, 2025

wbamberg Feb 5, 2025

hamishwillee Feb 6, 2025 •

edited

Loading

caugner Feb 7, 2025

hamishwillee commented Feb 7, 2025

caugner Feb 7, 2025

caugner Feb 7, 2025

caugner Feb 7, 2025

caugner Feb 7, 2025

caugner Feb 7, 2025

caugner Feb 7, 2025

caugner Feb 7, 2025

caugner Feb 7, 2025

-            "spec_url": "https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-document-write",
+            "spec_url": [
+              "https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#document-write-steps",
+              "https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#:~:text=if%20value%20is%20a%20trustedhtml%20object"
+            ],

		"mdn_url": "https://developer.mozilla.org/docs/Web/API/Document/writeln",
		"spec_url": "https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-document-writeln",

Trusted Types - FF updates and missing entries in TT spec #25839

Are you sure you want to change the base?

Trusted Types - FF updates and missing entries in TT spec #25839

Conversation

hamishwillee commented Feb 3, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wbamberg left a comment

Choose a reason for hiding this comment

wbamberg Feb 5, 2025 • edited Loading

Choose a reason for hiding this comment

hamishwillee Feb 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hamishwillee Feb 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hamishwillee commented Feb 7, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hamishwillee commented Feb 3, 2025 •

edited

Loading

wbamberg Feb 5, 2025 •

edited

Loading

hamishwillee Feb 6, 2025 •

edited

Loading

hamishwillee Feb 6, 2025 •

edited

Loading