|
1214 | 1214 | </style>
|
1215 | 1215 | <meta content="Bikeshed version 0dd2bba6dfda6c3168490a3a3044dd1d0b1ef8e0" name="generator">
|
1216 | 1216 | <link href="https://w3c.github.io/webappsec-trusted-types/dist/spec/" rel="canonical">
|
1217 |
| - <meta content="54cdd77d2a0f07adc944de3ed907680a6709fe0c" name="document-revision"> |
| 1217 | + <meta content="204a9c5a428338515a7653c097c3414873928b27" name="document-revision"> |
1218 | 1218 | <style>/* style-md-lists */
|
1219 | 1219 |
|
1220 | 1220 | /* This is a weird hack for me not yet following the commonmark spec
|
@@ -1594,8 +1594,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
|
1594 | 1594 | <ol class="toc">
|
1595 | 1595 | <li><a href="#cross-document-vectors"><span class="secno">5.1</span> <span class="content">Cross-document vectors</span></a>
|
1596 | 1596 | <li><a href="#deprecated-features"><span class="secno">5.2</span> <span class="content">Deprecated features</span></a>
|
1597 |
| - <li><a href="#bypass-vectors"><span class="secno">5.3</span> <span class="content">Bypass vectors</span></a> |
1598 |
| - <li><a href="#best-practices-for-policy-design"><span class="secno">5.4</span> <span class="content">Best practices for policy design</span></a> |
| 1597 | + <li><a href="#best-practices-for-policy-design"><span class="secno">5.3</span> <span class="content">Best practices for policy design</span></a> |
1599 | 1598 | </ol>
|
1600 | 1599 | <li>
|
1601 | 1600 | <a href="#implementation-considerations"><span class="secno">6</span> <span class="content">Implementation Considerations</span></a>
|
@@ -3282,10 +3281,7 @@ <h3 class="heading settled" data-level="5.2" id="deprecated-features"><span clas
|
3282 | 3281 | <li data-md>
|
3283 | 3282 | <p><a href="https://w3c.github.io/webcomponents/spec/imports/">HTML imports</a></p>
|
3284 | 3283 | </ul>
|
3285 |
| - <h3 class="heading settled" data-level="5.3" id="bypass-vectors"><span class="secno">5.3. </span><span class="content">Bypass vectors</span><a class="self-link" href="#bypass-vectors"></a></h3> |
3286 |
| - <p class="issue" id="issue-1c3973fc"><a class="self-link" href="#issue-1c3973fc"></a> Mention anchor element properties bypass. <a href="https://github.com/w3c/webappsec-trusted-types/issues/64"><https://github.com/w3c/webappsec-trusted-types/issues/64></a></p> |
3287 |
| - <p class="issue" id="issue-fb0cfdf0"><a class="self-link" href="#issue-fb0cfdf0"></a> Mention text/attribute node copy bypass vectors. <a href="https://github.com/w3c/webappsec-trusted-types/issues/47"><https://github.com/w3c/webappsec-trusted-types/issues/47></a></p> |
3288 |
| - <h3 class="heading settled" data-level="5.4" id="best-practices-for-policy-design"><span class="secno">5.4. </span><span class="content">Best practices for policy design</span><a class="self-link" href="#best-practices-for-policy-design"></a></h3> |
| 3284 | + <h3 class="heading settled" data-level="5.3" id="best-practices-for-policy-design"><span class="secno">5.3. </span><span class="content">Best practices for policy design</span><a class="self-link" href="#best-practices-for-policy-design"></a></h3> |
3289 | 3285 | <p>Trusted Types limit the scope of the code that can introduce DOM XSS
|
3290 | 3286 | vulnerabilities to the implementation of <a href="#policies">policies</a>. In this design,
|
3291 | 3287 | insecure policies can still enable XSS. Special emphasis needs to be taken by
|
@@ -4276,8 +4272,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
|
4276 | 4272 | Specifically when, there is a <a data-link-type="dfn" href="#default-policy">default policy</a>, <var>isExempt</var> is false,
|
4277 | 4273 | and <var>source</var> there is a CSP policy for either the <var>callerRealm</var> or <var>callerRealm</var> that disallows "<code>'unsafe-eval'"</code>.
|
4278 | 4274 | Is this a feature or a bug?<a href="#issue-649f8da4"> ↵ </a></div>
|
4279 |
| - <div class="issue"> Mention anchor element properties bypass. <a href="https://github.com/w3c/webappsec-trusted-types/issues/64"><https://github.com/w3c/webappsec-trusted-types/issues/64></a><a href="#issue-1c3973fc"> ↵ </a></div> |
4280 |
| - <div class="issue"> Mention text/attribute node copy bypass vectors. <a href="https://github.com/w3c/webappsec-trusted-types/issues/47"><https://github.com/w3c/webappsec-trusted-types/issues/47></a><a href="#issue-fb0cfdf0"> ↵ </a></div> |
4281 | 4275 | <div class="issue"> Refer to the external document on secure policy design.<a href="#issue-2eb927d2"> ↵ </a></div>
|
4282 | 4276 | </div>
|
4283 | 4277 | <aside class="dfn-panel" data-for="injection-sink">
|
|
0 commit comments