Trusted Types - FF updates and missing entries in TT spec #25839

hamishwillee · 2025-02-03T05:05:29Z

FF has added more support for trusted types behind a flag. This adds those updates.

Also it adds some missing entries, primarily for the methods and properties that will now accept trusted types. Some of this is a bit weird so I've added comments inline explaining how/why I did stuff.

FF135 The Document.write() and writeln() accept {{domxref("TrustedHTML")}} objects as parameters, in addition to strings. https://bugzilla.mozilla.org/show_bug.cgi?id=1906301 - I tested version support for Chrome using https://wpt.live/trusted-types/Document-write.html
The HTMLScriptElement.text, innerText, and textContent properties now accept TrustedScript as a setter, while HTMLScriptElement.src accepts TrustedScriptURL in https://bugzilla.mozilla.org/show_bug.cgi?id=1905706
- Note, the innerText and textContext were formerly inherited from HTMLElement and Node respectively.
FF135 supports setTimeout and setInterval taking a trustedtype - as a proxy for code in a script. But it isn't in the spec other than broadly referred to. I have added info though, because it is a compat issue - it should be listed in https://w3c.github.io/trusted-types/dist/spec/#dom-xss-injection-sinks
FF supports the global trustedTypes - you need to have that for anything to work. I have added this as though added in FF135. It might have appeared earlier, but not useful - I'm OK with it since all of that will change when this gets released.
Element.innerHTML and the shadow versions arent speced with alternative IDL saying it can take a trusted type, but there are examples which show that, and wpt tests, and they are mentioned in https://w3c.github.io/trusted-types/dist/spec/#dom-xss-injection-sinks - which I have used for the spec url.

The spec mentions some other cases such as Element.outerHTML setters, and functions that create a new same-origin Document with caller-controlled markup like parseFromString(). Have not added that, because I haven't tested it.

hamishwillee · 2025-02-03T05:08:33Z

api/Document.json

+            "status": {
+              "experimental": false,
+              "standard_track": true,
+              "deprecated": true


Note, this is set as not experimental and deprecated, because the parent is deprecated (and you can't have both set).

hamishwillee · 2025-02-03T05:10:56Z

api/HTMLScriptElement.json

@@ -417,6 +417,53 @@
          }
        }
      },
+      "innerText": {


So for this one (and textContent), the properties were around since forever, but inherited. Since this update only applies to the HTMLScriptElement I have added it here as though it were a new property.

Is this OK? I mean it looks like you can only access this from current version, which might be confusing to readers.

I think this will be confusing, yes, because innerText is also defined and BCD-ified in the parent HTMLElement: https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement#browser_compatibility.

And the innerText page takes its BCD from there: https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/innerText#browser_compatibility so this change won't even show up in that page.

Maybe instead of this, add a subfeature to HTMLElement.innerText, like: "Script elements can accept a TrustedScript"? Then it will show up as a subfeature in https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/innerText#browser_compatibility .

It depends on how important strict following of IDL is for BCD. I like the idea though - changed in df3f74f

api/HTMLScriptElement.json

api/_globals/setInterval.json

hamishwillee · 2025-02-03T06:12:37Z

api/_globals/trustedTypes.json

@@ -14,7 +14,14 @@
          "chrome_android": "mirror",
          "edge": "mirror",
          "firefox": {
-            "version_added": false,
+            "version_added": "135",


Not 100% sure when this became useful. The whole API was added behind pref in 125 and no implementation. I've put 135 because it does not harm and we're starting to get where tests can be useful.

hamishwillee · 2025-02-03T06:28:09Z

api/Element.json

@@ -6263,6 +6263,53 @@
            "standard_track": true,
            "deprecated": false
          }
+        },
+        "accepts_TrustedHtml": {


As for other cases, you can set the property with this, but if you were to get it back you'd get a string.

Interesting, I wonder if there would be any desire to formalize BCD subfeatures for property getters and setters.

That would be good. For now I have tried to be consistent.

wbamberg

@Elchi3 asked me for a "domain review" of this PR :).

wbamberg · 2025-02-05T17:59:26Z

api/Document.json

+        },
+        "text_param_accepts_TrustedHTML": {
+          "__compat": {
+            "description": "`text` parameter accepts `TrustedHTML` type",


The page calls the parameter markup so this will be confusing. Also IDK if anyone cares but I think strictly, the parameter doesn't "accept" anything - it is the function that accepts things. The parameter just is something.

Since this method only accepts one parameter we might not have to name the parameter and say "Accepts a TrustedHTML instance" or something like that.

Yes, changed to:

"accepts_TrustedHTML": { "__compat": { "description": "Accepts `TrustedHTML` instances",

This takes an arbitrary number of either/both strings or trusted HTML instances.

FYI I also changed this in my docs PR to text, but will revert, as markup is a better term.

api/Document.json

wbamberg · 2025-02-05T18:01:25Z

api/Element.json

@@ -6263,6 +6263,53 @@
            "standard_track": true,
            "deprecated": false
          }
+        },
+        "accepts_TrustedHtml": {


Interesting, I wonder if there would be any desire to formalize BCD subfeatures for property getters and setters.

wbamberg · 2025-02-05T18:07:17Z

api/HTMLScriptElement.json

@@ -417,6 +417,53 @@
          }
        }
      },
+      "innerText": {


I think this will be confusing, yes, because innerText is also defined and BCD-ified in the parent HTMLElement: https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement#browser_compatibility.

And the innerText page takes its BCD from there: https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/innerText#browser_compatibility so this change won't even show up in that page.

Maybe instead of this, add a subfeature to HTMLElement.innerText, like: "Script elements can accept a TrustedScript"? Then it will show up as a subfeature in https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/innerText#browser_compatibility .

api/HTMLScriptElement.json

api/ShadowRoot.json

api/_globals/setInterval.json

api/Document.json

api/Element.json

api/HTMLScriptElement.json

api/ShadowRoot.json

api/Element.json

hamishwillee · 2025-02-07T00:30:10Z

@wbamberg Thanks. Accepted all your suggestions - ready for another look

api/Document.json

caugner · 2025-02-07T13:35:20Z

api/Document.json

+            "mdn_url": "https://developer.mozilla.org/docs/Web/API/Document/writeln",
+            "spec_url": "https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-document-writeln",


dito (see above)

api/Document.json

caugner · 2025-02-07T13:43:32Z

api/Document.json

+            ],
+            "support": {
+              "chrome": {
+                "version_added": "83"


api/_globals/setInterval.json

api/_globals/setTimeout.json

Co-authored-by: Claas Augner <495429+caugner@users.noreply.github.com>

api/Document.json

api/Element.json

hamishwillee · 2025-02-09T22:38:02Z

api/Element.json

+            ],
+            "support": {
+              "chrome": {
+                "version_added": "83"


Keeping this as 83 - based on this test in browserstack passing in that version https://wpt.live/trusted-types/HTMLElement-generic.html

hamishwillee · 2025-02-09T22:38:22Z

api/HTMLElement.json

+            ],
+            "support": {
+              "chrome": {
+                "version_added": "83"


Keeping as 83 - based on https://wpt.live/trusted-types/HTMLElement-generic.html

api/HTMLScriptElement.json

hamishwillee · 2025-02-09T22:38:49Z

api/HTMLScriptElement.json

+            ],
+            "support": {
+              "chrome": {
+                "version_added": "83"


Keeping as 83 based on TT being allowed in that version https://wpt.live/trusted-types/trusted-types-reporting-for-HTMLScriptElement.html (other tests fail, but not that one)

api/HTMLScriptElement.json

api/ShadowRoot.json

Co-authored-by: Claas Augner <495429+caugner@users.noreply.github.com>

hamishwillee · 2025-02-09T22:50:06Z

Thanks @caugner ! I've accepted your comments, and removed a few more cases of mdn URLs in the "accept" features (i.e. "dittos")

hamishwillee added 5 commits February 3, 2025 14:10

Document.writeln() accepts trusted types

c305f2b

Document.writeln() and write() accepts trusted types

a460c0e

HTMLScriptElement.text accepts TrustedScript

753351c

HTMLScriptElement.src accepts TrustedScriptUrl

1c70fb3

HTMLScriptElement.innerText and .textContent accepts TrustedScript

8ede9b5

github-actions bot added data:api Compat data for Web APIs. https://developer.mozilla.org/docs/Web/API size:l [PR only] 101-1000 LoC changed labels Feb 3, 2025

Doc.write() undeprecate

d125e75

hamishwillee commented Feb 3, 2025

View reviewed changes

api/HTMLScriptElement.json Outdated Show resolved Hide resolved

setInterval and setTimeout take TrustedScript

620805b

hamishwillee commented Feb 3, 2025

View reviewed changes

api/_globals/setInterval.json Outdated Show resolved Hide resolved

hamishwillee added 2 commits February 3, 2025 17:07

global.trustedTypes - FF135

348b9ab

Experimental not false for any of this

16949d1

hamishwillee commented Feb 3, 2025

View reviewed changes

hamishwillee marked this pull request as ready for review February 3, 2025 06:16

hamishwillee added 2 commits February 3, 2025 17:24

Spec url for timers

64b1f2b

Element.innerHTML and ShadowRoot.innerHTML take trustedTypes

12e83bc

hamishwillee commented Feb 3, 2025

View reviewed changes

hamishwillee mentioned this pull request Feb 3, 2025

[WebAPI] Implement Trusted Types support for document.write()/document.writeln() mdn/content#37518

Open

11 tasks

wbamberg reviewed Feb 5, 2025

View reviewed changes

write/writeln to Accepts TrustedHTML instances

e3e7bb5

hamishwillee commented Feb 6, 2025

View reviewed changes

api/Document.json Show resolved Hide resolved

hamishwillee commented Feb 6, 2025

View reviewed changes

api/Element.json Outdated Show resolved Hide resolved

hamishwillee commented Feb 6, 2025

View reviewed changes

api/HTMLScriptElement.json Outdated Show resolved Hide resolved

hamishwillee commented Feb 6, 2025

View reviewed changes

api/ShadowRoot.json Outdated Show resolved Hide resolved

hamishwillee commented Feb 6, 2025

View reviewed changes

api/Element.json Outdated Show resolved Hide resolved

hamishwillee added 2 commits February 7, 2025 10:53

consistency "set with a XXX instance"

46fe354

Move innerText feature from script element to html element

df3f74f

hamishwillee added 2 commits February 7, 2025 11:16

Move textContent feature from script element to node

2851193

SetInterval/setTimeout fixes

5a9fbb3

hamishwillee requested a review from wbamberg February 7, 2025 00:29

caugner reviewed Feb 7, 2025

View reviewed changes

Update api/Document.json

4926e7f

Co-authored-by: Claas Augner <495429+caugner@users.noreply.github.com>