mirror of
https://github.com/servo/servo.git
synced 2025-08-06 06:00:15 +01:00
Implement "Create a Trusted Type" algorithm (#36454)
This algorithm is quite straightforward written in the specification, but leads to some type awkwardness in Rust. Most notably, the callbacks have different types and cannot be unified easily. They also return different string types. Similarly, the returning objects are all unique types and don't have a common denominator. Therefore, rather than implementing it in 1-to-1 fashion with the specification text, it instead uses callbacks to instruct the type system of what to call when. This is further complicated by the fact that the callback can exist or not, as well as return a value or not. This requires multiple unwrangling, combined with the fact that the algorithm should throw or not. All in all, the number of lines is relatively low compared to the specification algorithm and the Rust compiler does a lot of heavy lifting figuring out which type is what. Part of https://github.com/servo/servo/issues/36258 Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com> Co-authored-by: Josh Matthews <josh@joshmatthews.net>
This commit is contained in:
Tim van der Lippe
GitHub
parent
0c045fc247
commit
dcc88b53aa
28 changed files with 197 additions and 259 deletions
2
tests/wpt/meta/MANIFEST.json
vendored
2
tests/wpt/meta/MANIFEST.json
vendored
|
|
@ -815185,7 +815185,7 @@
|
|||
]
|
||||
],
|
||||
"TrustedTypePolicy-createXXX.html": [
|
||||
"4cd91aa2a2b26877e0c5cacdcaf5719f267a3cca",
|
||||
"f51f51d98455ebccdee31a5b0d844a926b27fc0e",
|
||||
[
|
||||
null,
|
||||
{}
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
[DOMParser-parseFromString.html]
|
||||
[document.innerText assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
|
@ -1,16 +1,10 @@
|
|||
[DedicatedWorker-importScripts.html]
|
||||
[importScripts with TrustedScriptURL works in dedicated worker]
|
||||
expected: FAIL
|
||||
|
||||
[importScripts with untrusted URLs throws in dedicated worker]
|
||||
expected: FAIL
|
||||
|
||||
[null is not a trusted script URL throws in dedicated worker]
|
||||
expected: FAIL
|
||||
|
||||
[importScripts with two URLs, both trusted, in dedicated worker]
|
||||
expected: FAIL
|
||||
|
||||
[importScripts with two URLs, both strings, in dedicated worker]
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +0,0 @@
|
|||
[Document-write.html]
|
||||
[document.write with html assigned via policy (successful transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[document.writeln with html assigned via policy (successful transformation).]
|
||||
expected: FAIL
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
[Element-insertAdjacentHTML.html]
|
||||
[insertAdjacentHTML with html assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
[Element-outerHTML.html]
|
||||
[outerHTML with html assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
[Element-setAttribute.html]
|
||||
[script.src assigned via policy (successful ScriptURL transformation)]
|
||||
expected: FAIL
|
||||
|
||||
[iframe.srcdoc assigned via policy (successful HTML transformation)]
|
||||
expected: FAIL
|
||||
|
||||
[script.src assigned via policy (successful script transformation)]
|
||||
expected: FAIL
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
[Element-setAttributeNS.html]
|
||||
[Element.setAttributeNS assigned via policy (successful HTML transformation)]
|
||||
expected: FAIL
|
||||
|
||||
[Element.setAttributeNS assigned via policy (successful Script transformation)]
|
||||
expected: FAIL
|
||||
|
||||
[Element.setAttributeNS assigned via policy (successful ScriptURL transformation)]
|
||||
expected: FAIL
|
||||
|
||||
[Element.setAttributeNS accepts a URL on <svg:image xlink:href/>]
|
||||
expected: FAIL
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
[Range-createContextualFragment.html]
|
||||
[range.createContextualFragment assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
|
@ -1,60 +0,0 @@
|
|||
[TrustedTypePolicy-createXXX.html]
|
||||
[calling undefined callbacks throws]
|
||||
expected: FAIL
|
||||
|
||||
[trustedTypes.createPolicy(.., null) creates empty policy.]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedHTML1 (TrustedHTML: s => null)]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedHTML2 (TrustedHTML: s => "well, " + s)]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedHTML3 (TrustedHTML: s => { throw new Error() })]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedHTML5 (TrustedHTML: s => aGlobalVarForSideEffectTesting + s)]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedHTML6 (TrustedHTML: function() {\n [native code\]\n})]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedHTML7 (TrustedHTML: s => aGlobalFunction(s))]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScript1 (TrustedScript: s => null)]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScript2 (TrustedScript: s => "well, " + s)]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScript3 (TrustedScript: s => { throw new Error() })]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScript5 (TrustedScript: s => aGlobalVarForSideEffectTesting + s)]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScript6 (TrustedScript: function() {\n [native code\]\n})]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScript7 (TrustedScript: s => aGlobalFunction(s))]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScriptURL1 (TrustedScriptURL: s => null)]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScriptURL2 (TrustedScriptURL: s => s + "#duck")]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScriptURL3 (TrustedScriptURL: s => { throw new Error() })]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScriptURL4 (TrustedScriptURL: s => s + "#" + aGlobalVarForSideEffectTesting)]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScriptURL5 (TrustedScriptURL: function() {\n [native code\]\n})]
|
||||
expected: FAIL
|
||||
|
||||
[TestPolicyTrustedScriptURL6 (TrustedScriptURL: s => anotherGlobalFunction(s))]
|
||||
expected: FAIL
|
||||
|
|
@ -1,75 +0,0 @@
|
|||
[TrustedTypePolicyFactory-createPolicy-createXYZTests.html]
|
||||
[html = null]
|
||||
expected: FAIL
|
||||
|
||||
[html = string + global string]
|
||||
expected: FAIL
|
||||
|
||||
[html = identity function, global string changed]
|
||||
expected: FAIL
|
||||
|
||||
[html = callback that throws]
|
||||
expected: FAIL
|
||||
|
||||
[html = this bound to an object]
|
||||
expected: FAIL
|
||||
|
||||
[html = this without bind]
|
||||
expected: FAIL
|
||||
|
||||
[html - calling undefined callback throws]
|
||||
expected: FAIL
|
||||
|
||||
[createHTML defined - calling undefined callbacks throws]
|
||||
expected: FAIL
|
||||
|
||||
[script = null]
|
||||
expected: FAIL
|
||||
|
||||
[script = string + global string]
|
||||
expected: FAIL
|
||||
|
||||
[script = identity function, global string changed]
|
||||
expected: FAIL
|
||||
|
||||
[script = callback that throws]
|
||||
expected: FAIL
|
||||
|
||||
[script = this bound to an object]
|
||||
expected: FAIL
|
||||
|
||||
[script = this without bind]
|
||||
expected: FAIL
|
||||
|
||||
[script - calling undefined callback throws]
|
||||
expected: FAIL
|
||||
|
||||
[createScript defined - calling undefined callbacks throws]
|
||||
expected: FAIL
|
||||
|
||||
[script_url = null]
|
||||
expected: FAIL
|
||||
|
||||
[script_url = string + global string]
|
||||
expected: FAIL
|
||||
|
||||
[script_url = identity function, global string changed]
|
||||
expected: FAIL
|
||||
|
||||
[script_url = callback that throws]
|
||||
expected: FAIL
|
||||
|
||||
[script_url = this bound to an object]
|
||||
expected: FAIL
|
||||
|
||||
[script_url = this without bind]
|
||||
expected: FAIL
|
||||
|
||||
[script_url - calling undefined callback throws]
|
||||
expected: FAIL
|
||||
|
||||
[createScriptURL defined - calling undefined callbacks throws]
|
||||
expected: FAIL
|
||||
|
||||
[Arbitrary number of arguments]
|
||||
expected: FAIL
|
||||
|
|
@ -1,7 +1,4 @@
|
|||
[block-string-assignment-to-DOMParser-parseFromString.html]
|
||||
[document.innerText assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[`document.innerText = string` throws.]
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,4 @@
|
|||
[block-string-assignment-to-Document-write.html]
|
||||
[document.write with html assigned via policy (successful URL transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[document.writeln with html assigned via policy (successful URL transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[`document.write(string)` throws]
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,4 @@
|
|||
[block-string-assignment-to-Element-insertAdjacentHTML.html]
|
||||
[insertAdjacentHTML with html assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[insertAdjacentHTML(TrustedHTML) throws SyntaxError DOMException when position invalid.]
|
||||
expected: FAIL
|
||||
|
||||
[`insertAdjacentHTML(string)` throws.]
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,4 @@
|
|||
[block-string-assignment-to-Element-outerHTML.html]
|
||||
[outerHTML with html assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[`outerHTML = string` throws.]
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -29,8 +29,5 @@
|
|||
[div.onclick accepts string and null after default policy was created.]
|
||||
expected: FAIL
|
||||
|
||||
[a.rel accepts a Trusted Type]
|
||||
expected: FAIL
|
||||
|
||||
[`script.src = setAttributeNode(embed.src)` with string works.]
|
||||
expected: FAIL
|
||||
|
|
|
|||
|
|
@ -1,12 +1,3 @@
|
|||
[block-string-assignment-to-Element-setAttributeNS.html]
|
||||
[Element.setAttributeNS assigned via policy (successful HTML transformation)]
|
||||
expected: FAIL
|
||||
|
||||
[Element.setAttributeNS assigned via policy (successful Script transformation)]
|
||||
expected: FAIL
|
||||
|
||||
[Element.setAttributeNS assigned via policy (successful ScriptURL transformation)]
|
||||
expected: FAIL
|
||||
|
||||
[Blocking non-TrustedScriptURL assignment to <svg:script xlink:href=...> works]
|
||||
expected: FAIL
|
||||
|
|
|
|||
|
|
@ -1,7 +1,4 @@
|
|||
[block-string-assignment-to-Element-setHTMLUnsafe.html]
|
||||
[element.setHTMLUnsafe(html) assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[`element.setHTMLUnsafe(string)` throws.]
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,4 @@
|
|||
[block-string-assignment-to-HTMLIFrameElement-srcdoc.html]
|
||||
[iframe.srcdoc assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[`iframe.srcdoc = string` throws.]
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,4 @@
|
|||
[block-string-assignment-to-Range-createContextualFragment.html]
|
||||
[range.createContextualFragment assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[`range.createContextualFragment(string)` throws.]
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,4 @@
|
|||
[block-string-assignment-to-ShadowRoot-innerHTML.html]
|
||||
[shadowRoot.innerHTML = html assigned via policy (successful HTML transformation).]
|
||||
expected: FAIL
|
||||
|
||||
[`shadowRoot.innerHTML = string` throws.]
|
||||
expected: FAIL
|
||||
|
||||
|
|
|
|||
|
|
@ -13,6 +13,3 @@
|
|||
|
||||
[indirect eval with TrustedScript and permissive CSP works.]
|
||||
expected: FAIL
|
||||
|
||||
[new Function with TrustedScript and permissive CSP works.]
|
||||
expected: FAIL
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
[trusted-types-duplicate-names.html]
|
||||
[policy - duplicate names]
|
||||
expected: FAIL
|
||||
|
|
@ -50,11 +50,18 @@
|
|||
function anotherGlobalFunction(s) { return s + "#" + this.foo; }
|
||||
var foo = "a global var named foo";
|
||||
|
||||
class WrappingClass {
|
||||
callback_to_capture_this(s) {
|
||||
return String(this);
|
||||
}
|
||||
}
|
||||
|
||||
const stringTestCases = [
|
||||
[ s => s, "whatever" ],
|
||||
[ s => null, "" ],
|
||||
[ s => "well, " + s, "well, whatever" ],
|
||||
[ s => { throw new Error() }, Error ],
|
||||
[ new WrappingClass().callback_to_capture_this, "null"],
|
||||
[ s => { aGlobalVarForSideEffectTesting = s; return s }, "whatever" ],
|
||||
[ s => aGlobalVarForSideEffectTesting + s, "whateverwhatever" ],
|
||||
[ aGlobalFunction.bind(aGlobalObject), "well, whatever" ],
|
||||
|
|
@ -66,6 +73,7 @@
|
|||
[ s => null, "" ],
|
||||
[ s => s + "#duck", INPUTS.SCRIPTURL + "#duck" ],
|
||||
[ s => { throw new Error() }, Error ],
|
||||
[ new WrappingClass().callback_to_capture_this, "null"],
|
||||
[ s => s + "#" + aGlobalVarForSideEffectTesting,
|
||||
INPUTS.SCRIPTURL + "#global" ],
|
||||
[ anotherGlobalFunction.bind(aGlobalObject), INPUTS.SCRIPTURL + "#well," ],
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue