Skip to content

Add test for importing a srcdoc attribute node from a non-TT realm to a TT iframe element throws #44323

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 10 commits into from Apr 15, 2024
Merged

Add test for importing a srcdoc attribute node from a non-TT realm to a TT iframe element throws #44323

merged 10 commits into from Apr 15, 2024

Conversation

ghost
Copy link

@ghost ghost commented Jan 31, 2024

First step to fix w3c/trusted-types#425.

Will add separate commits for the other tests requested at above ticket.

@wpt-pr-bot wpt-pr-bot requested a review from mikewest January 31, 2024 15:30
@ghost
Copy link
Author

ghost commented Feb 1, 2024

Stumbled on #44352, which either needs to be fixed or worked around.

Mirko Brodesser added 9 commits April 8, 2024 11:46
Schedule the new test before a default policy is created and simplify…
d120fc8 
… the new test
Move test to <block-string-assignment-to-Element-setAttributeNode.htm…
2c2ea19 
…l> and further simplify it
Add TODO
aeed729
Add remaining tests for the DOM integration of TT when attribute node…
f484397 
…s created in a non-TT enforcing realm are imported to a TT-enforcing realm

See
<https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation>.

This excludes tests for
<https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-event-handler-content-attributes>
which will have to be added once that part of the spec is propagated to
the HTML spec.

The remaining tests mentioned at
<w3c/trusted-types#425 (comment)> will be added in
separate commits.
Change test to check aTestElement's ownerDocument equals document
4a9e49c
Refactor test to use the XLink namespace for SVG's script element
d615169
Remove unnecessary assertions and explain in a comment that `aTestEle…
26c25f9 
…ment`'s and `sourceAttr`s realms differ
Change test to check setAttributeNode and setAttribute respect th…
b617318 
…e element's node document's global's CSP

Requires #45405 to be
fixed.
Use sourceFrame.contentWindow's TyperError constructor
dfd95a9
annevk
annevk approved these changes Apr 11, 2024
View reviewed changes
Copy link
Member

@annevk annevk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, this looks like the correct test.

I wonder if we should also test the inverse. That when you take an element out of a TT global, TT is no longer enforced for it.

@ghost
Copy link
Author

ghost commented Apr 11, 2024

Thanks, this looks like the correct test.

I wonder if we should also test the inverse. That when you take an element out of a TT global, TT is no longer enforced for it.

I don't know how relevant that scenario is.

@koto: any experience with that?

@annevk
Copy link
Member

annevk commented Apr 11, 2024

It's relevant for ensuring the specification is implemented correctly.

@ghost
Copy link
Author

ghost commented Apr 15, 2024

It's relevant for ensuring the specification is implemented correctly.

True; but is that scenario actually relevant in practice?

@annevk
Copy link
Member

annevk commented Apr 15, 2024

That does not matter for conformance tests. The whole point is that we can't know what websites might do and might rely on.

@ghost
Copy link
Author

ghost commented Apr 15, 2024

That does not matter for conformance tests. The whole point is that we can't know what websites might do and might rely on.

Agreed. Added w3c/trusted-types#425 (comment) so that another test will be added.

@ghost
Copy link
Author

ghost commented Apr 15, 2024

@annevk: can you please merge this test, I lack rights.

@annevk annevk merged commit 560c8d6 into web-platform-tests:master Apr 15, 2024
@fred-wang
Copy link
Contributor

For future reference, this test has the following issues:

  1. It's relying on iframes with srcdoc attribute, so per https://w3c.github.io/webappsec-csp/#security-inherit-csp they are inheriting the CSP policy from the main frame which contains a require-trusted-types-for directive. So we are actually moving from a TT realm to another TT realm, which is not what the test means to check. If you remove the document.body.append(sourceElement) line, you see that the setAttribute* calls continue to assert (which shouldn't be the case if they were in a non-TT realm)

  2. assert_throws_js is expecting the iframe realm's TypeError rather than the main frame realm's TypeError. IIUC this was changed after discussion on assert_throws_js fails for an element adopted from an iframe #45405 but I believe this is wrong: assert_throws_js fails for an element adopted from an iframe #45405 (comment)

I'll fix the test in https://bugzilla.mozilla.org/show_bug.cgi?id=1950626, probably moving the "which realm the TypeError is coming from" check into a separate test since that was not really what the initial test meant to check anyway.

moz-wptsync-bot pushed a commit that referenced this pull request Feb 28, 2025
@fred-wang @moz-wptsync-bot
Fix mistakes in Element-setAttribute-respects-Elements-node-documents…
bbfae38 
…-globals-CSP-after-adoption-from-non-TT-realm.html.

See #44323 (comment)

Also add a more direct test for the TypeError realm.

Differential Revision: https://phabricator.services.mozilla.com/D239894

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1950626
gecko-commit: cfc415b178e0e9719e0124df703b3125d1484251
gecko-reviewers: smaug
@moz-wptsync-bot moz-wptsync-bot mentioned this pull request Feb 28, 2025
Merged
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this pull request Feb 28, 2025
@fred-wang
Bug 1950626 Fix mistakes in Element-setAttribute-respects-Elements-no…
c5663a6 
…de-documents-globals-CSP-after-adoption-from-non-TT-realm.html. r=smaug

See web-platform-tests/wpt#44323 (comment)

Also add a more direct test for the TypeError realm.

Differential Revision: https://phabricator.services.mozilla.com/D239894
i3roly pushed a commit to i3roly/firefox-dynasty that referenced this pull request Feb 28, 2025
@fred-wang
Bug 1950626 Fix mistakes in Element-setAttribute-respects-Elements-no…
e1aca18 
…de-documents-globals-CSP-after-adoption-from-non-TT-realm.html. r=smaug

See web-platform-tests/wpt#44323 (comment)

Also add a more direct test for the TypeError realm.

Differential Revision: https://phabricator.services.mozilla.com/D239894
moz-wptsync-bot pushed a commit that referenced this pull request Feb 28, 2025
@fred-wang @moz-wptsync-bot
Fix mistakes in Element-setAttribute-respects-Elements-node-documents…
7bd6ffc 
…-globals-CSP-after-adoption-from-non-TT-realm.html.

See #44323 (comment)

Also add a more direct test for the TypeError realm.

Differential Revision: https://phabricator.services.mozilla.com/D239894

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1950626
gecko-commit: cfc415b178e0e9719e0124df703b3125d1484251
gecko-reviewers: smaug
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this pull request Mar 1, 2025
@marco-c
Bug 1950626 Fix mistakes in Element-setAttribute-respects-Elements-no…
ca7f389 
…de-documents-globals-CSP-after-adoption-from-non-TT-realm.html. r=smaug

See web-platform-tests/wpt#44323 (comment)

Also add a more direct test for the TypeError realm.

Differential Revision: https://phabricator.services.mozilla.com/D239894

UltraBlame original commit: cfc415b178e0e9719e0124df703b3125d1484251
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this pull request Mar 1, 2025
@marco-c
Bug 1950626 Fix mistakes in Element-setAttribute-respects-Elements-no…
b77d633 
…de-documents-globals-CSP-after-adoption-from-non-TT-realm.html. r=smaug

See web-platform-tests/wpt#44323 (comment)

Also add a more direct test for the TypeError realm.

Differential Revision: https://phabricator.services.mozilla.com/D239894

UltraBlame original commit: cfc415b178e0e9719e0124df703b3125d1484251
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this pull request Mar 1, 2025
@marco-c
Bug 1950626 Fix mistakes in Element-setAttribute-respects-Elements-no…
a990a18 
…de-documents-globals-CSP-after-adoption-from-non-TT-realm.html. r=smaug

See web-platform-tests/wpt#44323 (comment)

Also add a more direct test for the TypeError realm.

Differential Revision: https://phabricator.services.mozilla.com/D239894

UltraBlame original commit: cfc415b178e0e9719e0124df703b3125d1484251
jamienicol pushed a commit to jamienicol/gecko that referenced this pull request Mar 5, 2025
@fred-wang
Bug 1950626 Fix mistakes in Element-setAttribute-respects-Elements-no…
88044b5 
…de-documents-globals-CSP-after-adoption-from-non-TT-realm.html. r=smaug

See web-platform-tests/wpt#44323 (comment)

Also add a more direct test for the TypeError realm.

Differential Revision: https://phabricator.services.mozilla.com/D239894
glandium pushed a commit to mozilla-firefox/firefox that referenced this pull request Apr 1, 2025
@fred-wang
Bug 1950626 Fix mistakes in Element-setAttribute-respects-Elements-no…
b60caef 
…de-documents-globals-CSP-after-adoption-from-non-TT-realm.html. r=smaug

See web-platform-tests/wpt#44323 (comment)

Also add a more direct test for the TypeError realm.

Differential Revision: https://phabricator.services.mozilla.com/D239894
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mikewest mikewest Awaiting requested review from mikewest

Assignees

@mikewest mikewest

Labels
assets attribution-reporting ci console credential-management CSS2 css-anchor-position css-animations css-backgrounds css-cascade css-color css-contain css-display css-flexbox css-grid css-overflow css-page css-position css-scroll-snap css-text css-text-decor css-transitions css-ui css-values css-view-transitions css-writing-modes cssom-view custom-elements custom-state-pseudo-class dom editing encoding event-timing fenced-frame fetch fledge generic-sensor html infra intersection-observer long-animation-frame mathml mediacapture-insertable-streams mediacapture-record notifications orientation-event pointerevents printing requirements_tests.txt scroll-animations selection selectors serial service-workers shadow-dom shared-storage shared-storage-selecturl-limit speculation-rules svg trusted-types uievents web-animations web-locks webaudio webdriver webdriver-bidi webnn webrtc wg-cg_wicg wg-css wg-das wg-math wg-s_audio wg-s_htmlwg wg-s_pointer-events wg-s_webapps wg-s_webappsec wg-s_webmachinelearning wg-s_webperf wg-s_webrtc wg-svg wg-sw wg-testing_browser wg-wai_pf wg-webplatform workers wptrunner The automated test runner, commonly called through ./wpt run wptserve zoom
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Improve test coverage for DOM integration in WPT
7 participants
@annevk @fred-wang @lukewarlow @mikewest @cookiecrook @wpt-pr-bot @moz-wptsync-bot