From 4a04e8f59cafb3111702fb8c592b97c1500f0b46 Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Tue, 2 Apr 2024 13:50:53 +0100 Subject: [PATCH 1/4] Update IDL for script enforcement - Node/textContent, and Element/innerText are both now shadowed on HTMLScriptElement. HTMLScriptElement/textContent uses a union type rather than [StringContext] because it uses a nullable type. --- spec/index.bs | 63 ++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 47 insertions(+), 16 deletions(-) diff --git a/spec/index.bs b/spec/index.bs index 112c8e9..e7198fb 100644 --- a/spec/index.bs +++ b/spec/index.bs @@ -120,6 +120,11 @@ spec:ECMA-262; urlPrefix: https://tc39.github.io/ecma262/ type:dfn; text:current realm record; url: current-realm spec: HTML; urlPrefix: https://html.spec.whatwg.org/ type: dfn; text: prepare the script element; url: prepare-the-script-element + type: dfn; text: get the text steps; url: get-the-text-steps + type: dfn; text: set the inner text steps; url: set-the-inner-text-steps +spec:DOM; urlPrefix: https://dom.spec.whatwg.org/ + type: dfn; text: get text content; url: get-text-content + type: dfn; text: set text content; url: set-text-content 
@@ -1137,36 +1142,62 @@ type policy factory]].
 
 ### Enforcement for scripts ### {#enforcement-in-scripts}
 
-#### Slots with trusted values #### {#slots-with-trusted-values}
-
-This document modifies {{HTMLScriptElement}}s. Each script has:
-
-: an associated string script text.
-::  A string, containing the body of the script to execute that was set
-    through a {{StringContext}} compliant sink. Equivalent to script's
-    [=child text content=]. Initially an empty string.
-
-#### Setting slot values #### {#setting-slot-values}
-
 This document modifies how {{HTMLScriptElement}} [=child text content=] can be set to allow applications to control dynamically created scripts. It does so by
 adding the {{HTMLElement/innerText}} and {{Node/textContent}} attributes directly on {{HTMLScriptElement}}. The behavior of the attributes remains the same
 as in their original counterparts, apart from additional behavior triggered by the {{StringContext}} extended attribute presence.
 
-Note: Using these IDL attributes is the recommended way of dynamically setting URL or a text of a script. Manipulating attribute nodes or text nodes directly will call a default policy on the final value when the script is prepared.
+Note: Using these IDL attributes is the recommended way of dynamically setting the URL or a text of a script. Manipulating attribute nodes or text nodes directly will call a default policy on the final value when the script is prepared.
 
 
 partial interface HTMLScriptElement {
  [CEReactions] attribute [LegacyNullToEmptyString] ScriptString innerText;
- [CEReactions] attribute ScriptString? textContent;
+ [CEReactions] attribute (DOMString or TrustedScript)? textContent;
  [CEReactions] attribute ScriptURLString src;
  [CEReactions] attribute ScriptString text;
 };
 

 
-On setting the {{HTMLElement/innerText}}, {{Node/textContent}} and {{HTMLScriptElement/text}} IDL attributes execute the following algorithm:
+#### Slots with trusted values #### {#slots-with-trusted-values}
+
+This document modifies {{HTMLScriptElement}}s. Each script has:
+
+: an associated string script text.
+::  A string, containing the body of the script to execute that was set
+    through a {{StringContext}} compliant sink. Equivalent to script's
+    [=child text content=]. Initially an empty string.
+
+#### The {{HTMLScriptElement/innerText}} IDL attribute #### {#the-innerText-idl-attribute}
+
+The {{HTMLScriptElement/innerText}} setter steps are:
+
+1.  Set [=script text=] value to |value|.
+1.  Run [=set the inner text steps=] with [=this=] and |value|.
+
+The {{HTMLScriptElement/innerText}} getter steps are:
+
+1.  Return the result of running [=get the text steps=] with [=this=].
+
+#### The {{HTMLScriptElement/textContent}} IDL attribute #### {#the-textContent-idl-attribute}
+
+The {{HTMLScriptElement/textContent}} setter steps are to, if the given value is null, act as if it was the
+empty string instead, and then do as described below:
+
+1.  Let |value| be the result of calling [$Get Trusted Type compliant string$] with
+    {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement textContent`,
+    `script`.
+1.  Set [=script text=] value to |value|.
+1.  Run [=set text content=] with [=this=] and |value|.
+
+The {{HTMLScriptElement/textContent}} getter steps are:
+
+1.  Return the result of running [=get text content=] with [=this=].
+
+#### The {{HTMLScriptElement/text}} IDL attribute #### {#the-text-idl-attribute}
+
+Update the {{HTMLScriptElement/text}} setter steps algorithm as follows.
 
-1. Set [=script text=] value to the stringified attribute value.
-1. Perform the usual attribute setter steps.
+1.  Set [=script text=] value to the given value.
+1.  [=String replace all=] with the given value within this script element.
 
 #### Slot value verification #### {#slot-value-verification}
 

From 18a76ec6ed48574cff5279fdc6aec8727a0b1673 Mon Sep 17 00:00:00 2001
From: Luke Warlow 
Date: Thu, 4 Apr 2024 16:28:32 +0100
Subject: [PATCH 2/4] Swap to using union types for all the Script properties.

---
 spec/index.bs | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/spec/index.bs b/spec/index.bs
index e7198fb..0d02e04 100644
--- a/spec/index.bs
+++ b/spec/index.bs
@@ -122,6 +122,7 @@ spec: HTML; urlPrefix: https://html.spec.whatwg.org/
     type: dfn; text: prepare the script element; url: prepare-the-script-element
     type: dfn; text: get the text steps; url: get-the-text-steps
     type: dfn; text: set the inner text steps; url: set-the-inner-text-steps
+    type: dfn; text: src; url: attr-script-src
 spec:DOM; urlPrefix: https://dom.spec.whatwg.org/
     type: dfn; text: get text content; url: get-text-content
     type: dfn; text: set text content; url: set-text-content
@@ -1144,16 +1145,16 @@ type policy factory]].
 
 This document modifies how {{HTMLScriptElement}} [=child text content=] can be set to allow applications to control dynamically created scripts. It does so by
 adding the {{HTMLElement/innerText}} and {{Node/textContent}} attributes directly on {{HTMLScriptElement}}. The behavior of the attributes remains the same
-as in their original counterparts, apart from additional behavior triggered by the {{StringContext}} extended attribute presence.
+as in their original counterparts, apart from the additional behavior of calling [$Get Trusted Type compliant string$].
 
 Note: Using these IDL attributes is the recommended way of dynamically setting the URL or a text of a script. Manipulating attribute nodes or text nodes directly will call a default policy on the final value when the script is prepared.
 
 
 partial interface HTMLScriptElement {
- [CEReactions] attribute [LegacyNullToEmptyString] ScriptString innerText;
+ [CEReactions] attribute ([LegacyNullToEmptyString] DOMString or TrustedScript) innerText;
  [CEReactions] attribute (DOMString or TrustedScript)? textContent;
- [CEReactions] attribute ScriptURLString src;
- [CEReactions] attribute ScriptString text;
+ [CEReactions] attribute (USVString or TrustedScriptURL) src;
+ [CEReactions] attribute (DOMString or TrustedScript) text;
 };
 

 
@@ -1163,13 +1164,16 @@ This document modifies {{HTMLScriptElement}}s. Each script has:
 
 : an associated string script text.
 ::  A string, containing the body of the script to execute that was set
-    through a {{StringContext}} compliant sink. Equivalent to script's
+    through a compliant sink. Equivalent to script's
     [=child text content=]. Initially an empty string.
 
 #### The {{HTMLScriptElement/innerText}} IDL attribute #### {#the-innerText-idl-attribute}
 
 The {{HTMLScriptElement/innerText}} setter steps are:
 
+1.  Let |value| be the result of calling [$Get Trusted Type compliant string$] with
+    {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement innerText`, and
+    `script`.
 1.  Set [=script text=] value to |value|.
 1.  Run [=set the inner text steps=] with [=this=] and |value|.
 
@@ -1183,7 +1187,7 @@ The {{HTMLScriptElement/textContent}} setter steps are to, if the given value is
 empty string instead, and then do as described below:
 
 1.  Let |value| be the result of calling [$Get Trusted Type compliant string$] with
-    {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement textContent`,
+    {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement textContent`, and
     `script`.
 1.  Set [=script text=] value to |value|.
 1.  Run [=set text content=] with [=this=] and |value|.
@@ -1196,9 +1200,22 @@ The {{HTMLScriptElement/textContent}} getter steps are:
 
 Update the {{HTMLScriptElement/text}} setter steps algorithm as follows.
 
+1.  Let |value| be the result of calling [$Get Trusted Type compliant string$] with
+    {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement text`, and
+    `script`.
 1.  Set [=script text=] value to the given value.
 1.  [=String replace all=] with the given value within this script element.
 
+
+#### The {{HTMLScriptElement/src}} IDL attribute #### {#the-src-idl-attribute}
+
+The {{HTMLScriptElement/src}} setter steps are:
+
+1.  Let |value| be the result of calling [$Get Trusted Type compliant string$] with
+    {{TrustedScriptURL}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement src`, and
+    `script`.
+1.  Set [=this=]'s [=src=] content attribute to |value|.
+
 #### Slot value verification #### {#slot-value-verification}
 
 The first few steps of the [=prepare the script element=] algorithm are modified as follows:

From 97b6e9254093b5740eea4c0f63cc4656902b6aaa Mon Sep 17 00:00:00 2001
From: Luke Warlow 
Date: Thu, 18 Apr 2024 15:35:33 +0100
Subject: [PATCH 3/4] fixes

---
 spec/index.bs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/spec/index.bs b/spec/index.bs
index 0d02e04..67bb872 100644
--- a/spec/index.bs
+++ b/spec/index.bs
@@ -1174,7 +1174,7 @@ The {{HTMLScriptElement/innerText}} setter steps are:
 1.  Let |value| be the result of calling [$Get Trusted Type compliant string$] with
     {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement innerText`, and
     `script`.
-1.  Set [=script text=] value to |value|.
+1.  Set [=this=]'s [=script text=] value to |value|.
 1.  Run [=set the inner text steps=] with [=this=] and |value|.
 
 The {{HTMLScriptElement/innerText}} getter steps are:
@@ -1189,7 +1189,7 @@ empty string instead, and then do as described below:
 1.  Let |value| be the result of calling [$Get Trusted Type compliant string$] with
     {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement textContent`, and
     `script`.
-1.  Set [=script text=] value to |value|.
+1.  Set [=this=]'s [=script text=] value to |value|.
 1.  Run [=set text content=] with [=this=] and |value|.
 
 The {{HTMLScriptElement/textContent}} getter steps are:
@@ -1203,8 +1203,8 @@ Update the {{HTMLScriptElement/text}} setter steps algorithm as follows.
 1.  Let |value| be the result of calling [$Get Trusted Type compliant string$] with
     {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement text`, and
     `script`.
-1.  Set [=script text=] value to the given value.
-1.  [=String replace all=] with the given value within this script element.
+1.  Set [=this=]'s [=script text=] value to the given value.
+1.  [=String replace all=] with the given value within this.
 
 
 #### The {{HTMLScriptElement/src}} IDL attribute #### {#the-src-idl-attribute}

From 80b9076b9b9de4430624c7323bf5be603532fdf5 Mon Sep 17 00:00:00 2001
From: Luke Warlow 
Date: Mon, 22 Apr 2024 17:02:04 +0100
Subject: [PATCH 4/4] xref this

---
 spec/index.bs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/index.bs b/spec/index.bs
index 67bb872..7de4e74 100644
--- a/spec/index.bs
+++ b/spec/index.bs
@@ -1204,7 +1204,7 @@ Update the {{HTMLScriptElement/text}} setter steps algorithm as follows.
     {{TrustedScript}}, [=this=]'s [=relevant global object=], the given value, `HTMLScriptElement text`, and
     `script`.
 1.  Set [=this=]'s [=script text=] value to the given value.
-1.  [=String replace all=] with the given value within this.
+1.  [=String replace all=] with the given value within [=this=].
 
 
 #### The {{HTMLScriptElement/src}} IDL attribute #### {#the-src-idl-attribute}