Add additional context to the default policy invocations about trusted-types HOT 3 CLOSED

Yes, we thinking about that. What you described can be implemented in a default policy with some additional context when called (element, attr name).

FWIW, for now the shape of the default policy is the most controversial and volatile part of the specification, and we're purposefully not advertising it yet. The problem here is that it indeed facilitates migration of existing code but at the same time has a tendency to grow into an unreviewable mess (it has to accept everything that your dependencies can potentially set), and introduces subtle bugs into your code - it's like changing the prototype of base JS objects, an antipattern (but with security benefits). We're think on a way to make it less-global and more-local to the code.

from trusted-types.

#191 introduces sink parameter to a few algorithms. Currently it's an empty string, but we'll likely add it as an attribute to TrustedTypes extended attribute (which annotates the sinks).

from trusted-types.

I renamed the issue, as this is what is missing from the current design - and adding that would fullfill your requirements. Thanks!

from trusted-types.