Mismatch between spec IDL and Chromium implementation for TrustedTypePolicyOptions

[lukewarlow]

See https://w3c.github.io/trusted-types/dist/spec/#trusted-type-policy-options

dictionary TrustedTypePolicyOptions {
   CreateHTMLCallback? createHTML;
   CreateScriptCallback? createScript;
   CreateScriptURLCallback? createScriptURL;
};

callback CreateHTMLCallback = DOMString (DOMString input, any... args);
callback CreateScriptCallback = DOMString (DOMString input, any... args);
callback CreateScriptURLCallback = USVString (DOMString input, any... args);

Whereas in Chrome it's:

dictionary TrustedTypePolicyOptions {
   CreateHTMLCallback createHTML;
   CreateScriptCallback createScript;
   CreateURLCallback createScriptURL;
};

callback CreateHTMLCallback = DOMString? (DOMString input, any... args);
callback CreateScriptCallback = DOMString? (DOMString input, any... args);
callback CreateURLCallback = USVString? (DOMString input, any... args);

Aside from Chrome naming it URLCallback rather than ScriptURLCallback the nullability of the return type and options params are different.

Is the spec correct or is chrome correct in terms of what's expected?

[lukewarlow]

After #389 it's just the nullability inside the options dictionary that's different

[koto]

Good catch. I merged #389, it should also be

dictionary TrustedTypePolicyOptions {
   CreateHTMLCallback createHTML;
   CreateScriptCallback createScript;
   CreateURLCallback createScriptURL;
};

in the spec, i.e. trustedTypes.createPolicy('a', {createHTML: null}) should throw.