Comments (3)
Yes, we thinking about that. What you described can be implemented in a default policy with some additional context when called (element, attr name).
FWIW, for now the shape of the default policy is the most controversial and volatile part of the specification, and we're purposefully not advertising it yet. The problem here is that it indeed facilitates migration of existing code but at the same time has a tendency to grow into an unreviewable mess (it has to accept everything that your dependencies can potentially set), and introduces subtle bugs into your code - it's like changing the prototype of base JS objects, an antipattern (but with security benefits). We're think on a way to make it less-global and more-local to the code.
from trusted-types.
#191 introduces sink
parameter to a few algorithms. Currently it's an empty string, but we'll likely add it as an attribute to TrustedTypes
extended attribute (which annotates the sinks).
from trusted-types.
I renamed the issue, as this is what is missing from the current design - and adding that would fullfill your requirements. Thanks!
from trusted-types.
Related Issues (20)
- "Validate the string in context" takes any value and calls "Get Trusted Type compliant string" which requires a TrustedType or a string HOT 12
- CSP sample for eval and Function HOT 4
- Get trusted type compliant attribute value sink HOT 1
- Improve test coverage of sink values HOT 1
- Check variable naming inside of getAttributeType and getPropertyType methods
- `execCommand` spec won't work HOT 7
- `createPolicy`'s permitted policy names are inconsistent with CSP's permitted policy names HOT 5
- faq.md outdated HOT 1
- Script element protection model HOT 2
- WPT for CSP header `trusted-types 'none' 'none'` missing HOT 9
- "Should Trusted Type policy creation be blocked by Content Security Policy?" passes "directive" instead of directive's name to "Create a violation object for global, policy, and directive"
- Spec / implementation mismatch with document.write/writeln HOT 8
- "Create a Trusted Type Policy" should specify the TypeError messages HOT 3
- Should SVGScriptElement have an IDL way to set a trusted script value? HOT 2
- Add WPTs for CSP `sandbox allow-scripts` combined with Trusted Types HOT 2
- Should all 3 script IDL setters change the associated script text value identically HOT 11
- Seeking Trusted Types feedback on Array.isTemplateObject HOT 5
- Finalise spec mechanism for event handlers HOT 8
- getPropertyType and SVGScriptElement href baseVal property HOT 2
- Script element mid-parse protection mechanism HOT 10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from trusted-types.