You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently getPropertyType's spec and both Chromium and WebKit's implementation has no handling of the .href.baseVal property of an SVGScriptElement, but it does require a TrustedScriptURL.
Realistically we only have two choices, either ignore it (as baseVal is a property of SVGAnimatedString and not an element), or use a meta syntax like href.baseVal for the property name and add an entry for it in getPropertyType.
I have a slight preference to the former - getPropertyType does not cover all TT sinks, and we should just assume that SVG animations are another vector that needs to be handled separately.
Currently getPropertyType's spec and both Chromium and WebKit's implementation has no handling of the .href.baseVal property of an SVGScriptElement, but it does require a TrustedScriptURL.
cc @koto what should we do here?
The text was updated successfully, but these errors were encountered: