diff --git a/spec/index.bs b/spec/index.bs index 09eaadf..0048d9a 100644 --- a/spec/index.bs +++ b/spec/index.bs @@ -125,6 +125,7 @@ spec: HTML; urlPrefix: https://html.spec.whatwg.org/ type: dfn; text: prepare the script element; url: prepare-the-script-element type: dfn; text: get the text steps; url: get-the-text-steps type: dfn; text: set the inner text steps; url: set-the-inner-text-steps + type: dfn; text: src; url: attr-script-src spec:DOM; urlPrefix: https://dom.spec.whatwg.org/ type: dfn; text: get text content; url: get-text-content type: dfn; text: set text content; url: set-text-content @@ -1157,16 +1158,16 @@ type policy factory]]. This document modifies how {{HTMLScriptElement}} [=child text content=] can be set to allow applications to control dynamically created scripts. It does so by adding the {{HTMLElement/innerText}} and {{Node/textContent}} attributes directly on {{HTMLScriptElement}}. The behavior of the attributes remains the same -as in their original counterparts, apart from additional behavior triggered by the {{StringContext}} extended attribute presence. +as in their original counterparts, apart from the additional behavior of calling [$Get Trusted Type compliant string$]. Note: Using these IDL attributes is the recommended way of dynamically setting the URL or a text of a script. Manipulating attribute nodes or text nodes directly will call a default policy on the final value when the script is prepared.
 partial interface HTMLScriptElement {
- [CEReactions] attribute [LegacyNullToEmptyString] ScriptString innerText;
+ [CEReactions] attribute ([LegacyNullToEmptyString] DOMString or TrustedScript) innerText;
  [CEReactions] attribute (DOMString or TrustedScript)? textContent;
- [CEReactions] attribute ScriptURLString src;
- [CEReactions] attribute ScriptString text;
+ [CEReactions] attribute (USVString or TrustedScriptURL) src;
+ [CEReactions] attribute (DOMString or TrustedScript) text;
 };
 
@@ -1176,13 +1177,16 @@ This document modifies {{HTMLScriptElement}}s. Each script has: : `[[ScriptText]]` internal slot. :: A string, containing the body of the script to execute that was set - through a {{StringContext}} compliant sink. Equivalent to script's + through a compliant sink. Equivalent to script's [=child text content=]. Initially null. #### The {{HTMLScriptElement/innerText}} IDL attribute #### {#the-innerText-idl-attribute} The {{HTMLScriptElement/innerText}} setter steps are: +1. Let |value| be the result of calling [$Get Trusted Type compliant string$] with + {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement innerText`, and + `script`. 1. Set {{HTMLScriptElement/[[ScriptText]]}} internal slot value to |value|. 1. Run [=set the inner text steps=] with [=this=] and |value|. @@ -1196,7 +1200,7 @@ The {{HTMLScriptElement/textContent}} setter steps are to, if the given value is empty string instead, and then do as described below: 1. Let |value| be the result of calling [$Get Trusted Type compliant string$] with - {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement textContent`, + {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement textContent`, and `script`. 1. Set {{HTMLScriptElement/[[ScriptText]]}} internal slot value to |value|. 1. Run [=set text content=] with [=this=] and |value|. @@ -1209,9 +1213,22 @@ The {{HTMLScriptElement/textContent}} getter steps are: Update the {{HTMLScriptElement/text}} setter steps algorithm as follows. +1. Let |value| be the result of calling [$Get Trusted Type compliant string$] with + {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement text`, and + `script`. 1. Set {{HTMLScriptElement/[[ScriptText]]}} internal slot value to the given value. 1. [=String replace all=] with the given value within this script element. + +#### The {{HTMLScriptElement/src}} IDL attribute #### {#the-src-idl-attribute} + +The {{HTMLScriptElement/src}} setter steps are: + +1. Let |value| be the result of calling [$Get Trusted Type compliant string$] with + {{TrustedScriptURL}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement src`, and + `script`. +1. Set [=this=]'s [=src=] content attribute to |value|. + #### Slot value verification #### {#slot-value-verification} The first few steps of the [=prepare the script element=] algorithm are modified as follows: