Consider adding a type for base.href

[koto]

Extracted from #152:

@briansmith:

I expect that most people who would use Trusted Types don't want <base> to be used at all and so it should be easy to implement the equivalent of CSP base-uri 'none' (and maybe base-uri 'self') in a Trusted-Types policy. This makes me think that base URLs shouldn't have the same type as other URLs.

Currently the base URL requires TrustedScriptURL due to it being more powerful than TrustedURL, but it has some unique capabilities which is to change the meaning of other TrustedScriptURL and TrustedURL instances.

[mikesamuel]

<base href="javascript:alert(1)//">
<a href="#">link</a>
<br>
<script>
const { href } = document.querySelector('a');
document.body.appendChild(document.createTextNode(href))
</script>

Firefox and Safari show the href as javascript:alert(1)//#. Chrome rejects the <base>.

[koto]

Chrome disallows javascript: base URLs (http://crbug.com/679318), other browsers don't follow that behavior: whatwg/html#2249.

The issue though is mostly about changing the meaning of relative URLs, rather than javascript: prefix in specific. Changing script URLs to point to a different host would be equally bad.

[mikesamuel]

In Google internal code, we allow deriving a TrustedScriptURL from a TrustedScriptURL by adding query parameters or changing the hash.

That seems similar to the consequences of <base href>