From 305ee39af4dacea9ebcd8c774a3b753358554daf Mon Sep 17 00:00:00 2001 From: Krzysztof Kotowicz <koto@google.com> Date: Tue, 20 Sep 2022 17:21:22 +0200 Subject: [PATCH] Changed the links to reflect the renamed repository. --- README.md | 11 +++++------ explainer.md | 4 ++-- spec/index.bs | 6 +++--- tests/enforcer_test.js | 2 +- 4 files changed, 11 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index d10db5ff..bf967726 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,6 @@ -[](https://travis-ci.org/w3c/webappsec-trusted-types)   - +  [](https://www.browserstack.com/automate/public-build/eGZQNXU1U09vZjkrZzYzU3YrQ2FsbUpheGczR0VmMTZUSjBydnNjd1pKTT0tLTZPMWVJTnU1UHJvYjFCb0pHQmlsaXc9PQ%3d%3d--295829245abf0dd0cd150f9ca4fe3198da38747b) @@ -11,7 +10,7 @@ First time here? This is a repository hosting the Trusted Types specification dr * [Introduction for web developers](https://web.dev/trusted-types/) - API description with examples. * [Explainer](explainer.md) - introductory explainer (what problem is the API solving?). - * [Specification draft](https://w3c.github.io/webappsec-trusted-types/dist/spec/) - a more comprehensive and formalized description of the Trusted Types API. + * [Specification draft](https://w3c.github.io/trusted-types/dist/spec/) - a more comprehensive and formalized description of the Trusted Types API. * [Browser Support](https://caniuse.com/trusted-types) - The API is available natively in browsers based on Chromium version 83 and up. ## Polyfill @@ -83,7 +82,7 @@ $ npm run build ``` ## Demo -To see the polyfill in action, visit the [demo page](https://w3c.github.io/webappsec-trusted-types/demo/). +To see the polyfill in action, visit the [demo page](https://w3c.github.io/trusted-types/demo/). ## Testing It can be tested by running: @@ -104,5 +103,5 @@ See [CONTRIBUTING](CONTRIBUTING.md). # Questions? -Our [wiki](https://github.com/w3c/webappsec-trusted-types/wiki) or the [specification](https://w3c.github.io/webappsec-trusted-types/dist/spec/) may already contain an answer -to your question. If not, please [contact us](https://github.com/w3c/webappsec-trusted-types/wiki/Contact)! +Our [wiki](https://github.com/w3c/trusted-types/wiki) or the [specification](https://w3c.github.io/trusted-types/dist/spec/) may already contain an answer +to your question. If not, please [contact us](https://github.com/w3c/trusted-types/wiki/Contact)! diff --git a/explainer.md b/explainer.md index 16445ec2..f0ebe546 100644 --- a/explainer.md +++ b/explainer.md @@ -95,7 +95,7 @@ We identified three types that match the different contexts relevant for DOM XSS Introducing and requiring typed objects is, sadly, not sufficient: Exposing raw Trusted Types constructors to the web authors presents a significant problem, in that it only marginally improves the situation: while it allows certain libraries to produce and use typed -values in place of strings, it also allows constructing the types at will (see https://github.com/w3c/webappsec-trusted-types/issues/31), and every +values in place of strings, it also allows constructing the types at will (see https://github.com/w3c/trusted-types/issues/31), and every typed value construction in the application is a potential DOM XSS. Consider the following code snippet from the previous version of the API: @@ -186,7 +186,7 @@ if a dependency is used twice in an application). One of the policies the application may create is special, in that it allows to use strings with the injection sinks. These strings would be passed to a single user-defined policy that sanitizes the value or rejects it. The intention is to allow for a gradual migration of the code from strings towards Trusted Types. -Please check the [specification draft](https://w3c.github.io/webappsec-trusted-types/dist/spec/#default-policy-hdr) for details. +Please check the [specification draft](https://w3c.github.io/trusted-types/dist/spec/#default-policy-hdr) for details. ### javascript: URLs diff --git a/spec/index.bs b/spec/index.bs index 2215b905..88f5a658 100644 --- a/spec/index.bs +++ b/spec/index.bs @@ -1,6 +1,6 @@ <!-- Before editing this document, please see -https://github.com/w3c/webappsec-trusted-types/blob/master/README.md#spec-changes +https://github.com/w3c/trusted-types/blob/master/README.md#spec-changes --> <pre class='metadata'> @@ -9,10 +9,10 @@ Shortname: trusted-types Group: webappsec Level: none Status: ED -URL: https://w3c.github.io/webappsec-trusted-types/dist/spec/ +URL: https://w3c.github.io/trusted-types/dist/spec/ Editor: Krzysztof Kotowicz, Google LLC https://google.com, koto@google.com Former Editor: Mike West, Google LLC https://google.com, mkwst@google.com -Repository: w3c/webappsec-trusted-types +Repository: w3c/trusted-types Abstract: An API that allows applications to lock down powerful APIs to only accept non-spoofable, typed values in place of strings to prevent vulnerabilities caused by using these APIs with attacker-controlled inputs. Markup Shorthands: algorithm yes, biblio yes, css no, dfn yes, markdown yes, markup yes Ignored Terms: h1, h2, h3, h4, h5, h6, xmp, EmptyString diff --git a/tests/enforcer_test.js b/tests/enforcer_test.js index 2f293a1c..62d75008 100644 --- a/tests/enforcer_test.js +++ b/tests/enforcer_test.js @@ -102,7 +102,7 @@ describe('TrustedTypesEnforcer', function() { s.appendChild(p); // TODO: enable once - // https://github.com/w3c/webappsec-trusted-types/issues/133#issuecomment-727900669 + // https://github.com/w3c/trusted-types/issues/133#issuecomment-727900669 // is fixed. // expect(() => { // s.insertAdjacentText(