Skip to content

Commit 1d1182c

Browse files
tete17gmta
tete17
authored and
gmta
committed
LibWeb: Update get_trusted_type_data_for_attribute according to the spec
It now takes into consideration the namespace of the element to decide if it needs a TrustedType or not. We also win a few WPT subtests :)
1 parent d601bad commit 1d1182c

15 files changed

+1778
-14
lines changed

‎Libraries/LibWeb/TrustedTypes/TrustedTypePolicy.cpp‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -355,7 +355,9 @@ WebIDL::ExceptionOr<Utf16String> get_trusted_types_compliant_attribute_value(Fly
355355
// attributeName
356356
// attributeNs
357357
auto const attribute_data = get_trusted_type_data_for_attribute(
358-
element_interface_name(Utf16String::from_utf8(element.local_name()), attribute_ns.has_value() ? attribute_ns.value() : Utf16String::from_utf8(Namespace::HTML)),
358+
element_interface(
359+
Utf16String::from_utf8(element.local_name()),
360+
element.namespace_uri().value_or(Namespace::HTML)),
359361
Utf16String::from_utf8(attribute_name),
360362
attribute_ns);
361363

@@ -393,18 +395,18 @@ WebIDL::ExceptionOr<Utf16String> get_trusted_types_compliant_attribute_value(Fly
393395
Script.to_string());
394396
}
395397

396-
Utf16String element_interface_name(Utf16String const& local_name, Utf16String const& element_ns)
398+
ElementInterface element_interface(Utf16String const& local_name, FlyString const& element_ns)
397399
{
398400
// FIXME: We don't have a method in ElementFactory that can give us the interface name but these are all the cases
399401
// we care about in the table in get_trusted_type_data_for_attribute function
400402
if (local_name == HTML::TagNames::iframe && element_ns == Namespace::HTML)
401-
return "HTMLIFrameElement"_utf16;
403+
return { "HTMLIFrameElement"_utf16, element_ns };
402404
if (local_name == HTML::TagNames::script && element_ns == Namespace::HTML)
403-
return "HTMLScriptElement"_utf16;
405+
return { "HTMLScriptElement"_utf16, element_ns };
404406
if (local_name == SVG::TagNames::script && element_ns == Namespace::SVG)
405-
return "SVGScriptElement"_utf16;
407+
return { "SVGScriptElement"_utf16, element_ns };
406408

407-
return "Element"_utf16;
409+
return { "Element"_utf16, element_ns };
408410
}
409411

410412
}

‎Libraries/LibWeb/TrustedTypes/TrustedTypePolicy.h‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
#pragma once
88

9+
#include <AK/FlyString.h>
910
#include <LibJS/Forward.h>
1011
#include <LibWeb/Bindings/PlatformObject.h>
1112
#include <LibWeb/Bindings/TrustedTypePolicyPrototype.h>
@@ -71,6 +72,12 @@ WebIDL::ExceptionOr<Utf16String> get_trusted_type_compliant_string(TrustedTypeNa
7172

7273
WebIDL::ExceptionOr<Utf16String> get_trusted_types_compliant_attribute_value(FlyString const& attribute_name, Optional<Utf16String> attribute_ns, DOM::Element const& element, Variant<GC::Root<TrustedHTML>, GC::Root<TrustedScript>, GC::Root<TrustedScriptURL>, Utf16String> const& new_value);
7374

74-
Utf16String element_interface_name(Utf16String const& local_name, Utf16String const& element_ns);
75+
// FIXME: Add-hoc definition of an element interface
76+
struct ElementInterface {
77+
Utf16String element_name;
78+
FlyString element_ns;
79+
};
80+
81+
ElementInterface element_interface(Utf16String const& local_name, FlyString const& element_ns);
7582

7683
}

‎Libraries/LibWeb/TrustedTypes/TrustedTypePolicyFactory.cpp‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ Optional<Utf16String> TrustedTypePolicyFactory::get_attribute_type(Utf16String c
4949
attr_ns.clear();
5050

5151
// 5. Let interface be the element interface for localName and elementNs.
52-
Utf16String const interface = element_interface_name(local_name, element_ns.value());
52+
auto const interface = element_interface(local_name, element_ns.value().to_utf8());
5353

5454
// 6. Let expectedType be null.
5555
Optional<Utf16String> expected_type {};
@@ -297,13 +297,16 @@ ContentSecurityPolicy::Directives::Directive::Result TrustedTypePolicyFactory::s
297297
}
298298

299299
// https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute
300-
Optional<TrustedTypeData> get_trusted_type_data_for_attribute(Utf16String const& element, Utf16String const& attribute, Optional<Utf16String> const& attribute_ns)
300+
Optional<TrustedTypeData> get_trusted_type_data_for_attribute(ElementInterface const& element, Utf16String const& attribute, Optional<Utf16String> const& attribute_ns)
301301
{
302302
// 1. Let data be null.
303303
Optional<TrustedTypeData const&> data {};
304304

305-
// 2. If attributeNs is null, and attribute is the name of an event handler content attribute, then:
306-
if (!attribute_ns.has_value()) {
305+
auto const& [element_name, element_ns] = element;
306+
307+
// 2. If attributeNs is null, « HTML namespace, SVG namespace, MathML namespace » contains element’s namespace, and attribute is the name of an event handler content attribute:
308+
if (!attribute_ns.has_value()
309+
&& (Namespace::HTML == element_ns || Namespace::SVG == element_ns || Namespace::MathML == element_ns)) {
307310
#undef __ENUMERATE
308311
#define __ENUMERATE(attribute_name, event_name) \
309312
if (attribute == HTML::AttributeNames::attribute_name) { \
@@ -324,8 +327,8 @@ Optional<TrustedTypeData> get_trusted_type_data_for_attribute(Utf16String const&
324327

325328
// 3. Find the row in the following table, where element is in the first column, attributeNs is in the second column,
326329
// and attribute is in the third column. If a matching row is found, set data to that row.
327-
data = table.first_matching([&element, &attribute, &attribute_ns](auto const& row) {
328-
return row.element == element && row.attribute_ns == attribute_ns && row.attribute_local_name == attribute;
330+
data = table.first_matching([&element_name, &attribute, &attribute_ns](auto const& row) {
331+
return row.element == element_name && row.attribute_ns == attribute_ns && row.attribute_local_name == attribute;
329332
});
330333

331334
// 4. Return data

‎Libraries/LibWeb/TrustedTypes/TrustedTypePolicyFactory.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,6 @@ struct TrustedTypeData {
6969
InjectionSink sink;
7070
};
7171

72-
Optional<TrustedTypeData> get_trusted_type_data_for_attribute(Utf16String const&, Utf16String const&, Optional<Utf16String> const&);
72+
Optional<TrustedTypeData> get_trusted_type_data_for_attribute(ElementInterface const& element, Utf16String const&, Optional<Utf16String> const&);
7373

7474
}

‎Tests/LibWeb/Text/expected/wpt-import/trusted-types/Element-setAttribute-setAttributeNS-sinks.tentative.txt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Harness status: OK
2+
3+
Found 7 tests
4+
5+
7 Pass
6+
Pass HTMLIFrameElement.setAttribute('srcdoc', plain_string)
7+
Pass HTMLIFrameElement.setAttributeNS(null, 'srcdoc', plain_string)
8+
Pass HTMLScriptElement.setAttribute('src', plain_string)
9+
Pass HTMLScriptElement.setAttributeNS(null, 'src', plain_string)
10+
Pass SVGScriptElement.setAttribute('href', plain_string)
11+
Pass SVGScriptElement.setAttributeNS(null, 'href', plain_string)
12+
Pass SVGScriptElement.setAttributeNS(NSURI_XLINK, 'href', plain_string)

‎Tests/LibWeb/Text/expected/wpt-import/trusted-types/TrustedTypePolicyFactory-getAttributeType.txt‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
Harness status: OK
2+
3+
Found 23 tests
4+
5+
23 Pass
6+
Pass getAttributeType(
7+
"DIV",
8+
"onclick",
9+
"http://www.w3.org/1999/xhtml",
10+
"null") == "TrustedScript"
11+
Pass getAttributeType(
12+
"g",
13+
"ondblclick",
14+
"http://www.w3.org/2000/svg",
15+
"null") == "TrustedScript"
16+
Pass getAttributeType(
17+
"mrow",
18+
"onmousedown",
19+
"http://www.w3.org/1998/Math/MathML",
20+
"null") == "TrustedScript"
21+
Pass getAttributeType(
22+
"IFRAME",
23+
"srcdoc",
24+
"http://www.w3.org/1999/xhtml",
25+
"null") == "TrustedHTML"
26+
Pass getAttributeType(
27+
"SCRIPT",
28+
"src",
29+
"http://www.w3.org/1999/xhtml",
30+
"null") == "TrustedScriptURL"
31+
Pass getAttributeType(
32+
"script",
33+
"href",
34+
"http://www.w3.org/2000/svg",
35+
"null") == "TrustedScriptURL"
36+
Pass getAttributeType(
37+
"script",
38+
"href",
39+
"http://www.w3.org/2000/svg",
40+
"http://www.w3.org/1999/xlink") == "TrustedScriptURL"
41+
Pass getAttributeType(
42+
"foo",
43+
"onmouseup",
44+
"https://example.com/namespace",
45+
"null") == "null"
46+
Pass getAttributeType(
47+
"DIV",
48+
"onclick",
49+
"http://www.w3.org/1999/xhtml",
50+
"https://example.com/namespace") == "null"
51+
Pass getAttributeType(
52+
"DIV",
53+
"ondoesnotexist",
54+
"http://www.w3.org/1999/xhtml",
55+
"null") == "null"
56+
Pass getAttributeType(
57+
"DIV",
58+
"data-onclick",
59+
"http://www.w3.org/1999/xhtml",
60+
"null") == "null"
61+
Pass getAttributeType(
62+
"DIV",
63+
"srcdoc",
64+
"http://www.w3.org/1999/xhtml",
65+
"null") == "null"
66+
Pass getAttributeType(
67+
"iframe",
68+
"srcdoc",
69+
"https://example.com/namespace",
70+
"null") == "null"
71+
Pass getAttributeType(
72+
"IFRAME",
73+
"srcdoc",
74+
"http://www.w3.org/1999/xhtml",
75+
"https://example.com/namespace") == "null"
76+
Pass getAttributeType(
77+
"IFRAME",
78+
"data-srcdoc",
79+
"http://www.w3.org/1999/xhtml",
80+
"null") == "null"
81+
Pass getAttributeType(
82+
"DIV",
83+
"src",
84+
"http://www.w3.org/1999/xhtml",
85+
"null") == "null"
86+
Pass getAttributeType(
87+
"script",
88+
"src",
89+
"https://example.com/namespace",
90+
"null") == "null"
91+
Pass getAttributeType(
92+
"SCRIPT",
93+
"src",
94+
"http://www.w3.org/1999/xhtml",
95+
"https://example.com/namespace") == "null"
96+
Pass getAttributeType(
97+
"SCRIPT",
98+
"data-src",
99+
"http://www.w3.org/1999/xhtml",
100+
"null") == "null"
101+
Pass getAttributeType(
102+
"g",
103+
"href",
104+
"http://www.w3.org/2000/svg",
105+
"null") == "null"
106+
Pass getAttributeType(
107+
"SCRIPT",
108+
"href",
109+
"http://www.w3.org/1999/xhtml",
110+
"null") == "null"
111+
Pass getAttributeType(
112+
"script",
113+
"href",
114+
"http://www.w3.org/2000/svg",
115+
"https://example.com/namespace") == "null"
116+
Pass getAttributeType(
117+
"script",
118+
"src",
119+
"http://www.w3.org/2000/svg",
120+
"null") == "null"

0 commit comments

Comments
 (0)