diff --git a/spec/index.bs b/spec/index.bs index f5ee424..8196c15 100644 --- a/spec/index.bs +++ b/spec/index.bs @@ -1112,6 +1112,8 @@ To get Trusted Types-compliant attribute value on If the algorithm threw an error, rethrow the error. +Issue: This algorithm should account for event handler attributes. See https://github.com/w3c/trusted-types/issues/474 + # Integrations # {#integrations}
@@ -1224,37 +1226,6 @@ change step 8.4.3 as follows:
 
 1.  Perform HostEnsureCanCompileStringsEnsureCSPDoesNotBlockStringCompilation(realm, « », handler, false, handler, ~timer~, « », handler). If this throws an exception, catch it, report the exception, and abort these steps.
 
-### Enforcement in event handler content attributes ### {#enforcement-in-event-handler-content-attributes}
-
-This document modifies the
-[=attribute change steps=] for an [[HTML5#event-handler-content-attributes|event handler content attribute]].
-
-At the beginning of step 5, insert the following steps:
-
-1.  Let |value| be the result of executing the
-    [$Get Trusted Type compliant string$] algorithm, with the following arguments:
-    *   |value| as |input|,
-    *   {{TrustedScript}} as |expectedType|,
-    *   `'script'` as |sinkGroup|
-    *   |sink| being the result of [=concatenating=] the list « element's [=Element/local name=], |localName| » with `"."` as a |separator|.
-
-        Note: For example, `document.createElement('div').onclick = value` will result in |sink| being `'div.onclick'`.
-
-    *   eventTarget's [=relevant global object=] as |global|,
-
-1.  If the algorithm throws an error, abort these steps.
-
-Note: This also applies to events in [[SVG2#EventAttributes]].
-
-
-
-  // Content-Security-Policy: require-trusted-types-for 'script'
-
-  const img = document.createElement('img');
-  img.setAttribute('onerror', 'alert(1)'); // TypeError
-  
-
- ### HostEnsureCanCompileStrings ### {#host-ensure-can-compile-strings} JavaScript contains an implementation-defined HostEnsureCanCompileStrings(realm, parameterStrings,