From 9fe5f14c66482909cc033f22d88e2167c47d40d1 Mon Sep 17 00:00:00 2001 From: Mirko Brodesser Date: Tue, 10 Dec 2024 16:32:36 +0000 Subject: [PATCH] part 2) Transform the test which is commented out in to a valid one which is executed. Regarding the removed TODO: checking one non-null namespace should suffice, since other non-null namespaces likely take the same codepath. Differential Revision: https://phabricator.services.mozilla.com/D231565 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1907849 gecko-commit: bc406a35457dd43ee7e738683b1a4817e993def1 gecko-reviewers: smaug --- trusted-types/Element-setAttributeNS.html | 17 ++++-------- ...-assignment-to-Element-setAttributeNS.html | 27 +++++++++---------- trusted-types/support/helper.sub.js | 2 +- 3 files changed, 18 insertions(+), 28 deletions(-) diff --git a/trusted-types/Element-setAttributeNS.html b/trusted-types/Element-setAttributeNS.html index 67e8236febd77e..537b08be89b4e1 100644 --- a/trusted-types/Element-setAttributeNS.html +++ b/trusted-types/Element-setAttributeNS.html @@ -3,6 +3,7 @@ + diff --git a/trusted-types/block-string-assignment-to-Element-setAttributeNS.html b/trusted-types/block-string-assignment-to-Element-setAttributeNS.html index 78c8c0db989380..ba9bcc20d242ba 100644 --- a/trusted-types/block-string-assignment-to-Element-setAttributeNS.html +++ b/trusted-types/block-string-assignment-to-Element-setAttributeNS.html @@ -4,7 +4,7 @@ - + @@ -25,11 +25,11 @@ // Unknown attributes should not be TT checked: test(t => { - assert_element_accepts_non_trusted_type_set_ns('a', 'b', 'A string', 'A string', htmlNamespace, null); + assert_element_accepts_value_set_ns('a', 'b', 'A string', 'A string', htmlNamespace, null); }, "Element.setAttributeNS accepts untrusted string for non-specced accessor"); test(t => { - assert_element_accepts_non_trusted_type_set_ns('a', 'b', null, 'null', htmlNamespace, null); + assert_element_accepts_value_set_ns('a', 'b', null, 'null', htmlNamespace, null); }, "Element.setAttributeNS accepts null for non-specced accessor"); // Setup trusted values for use in subsequent tests. @@ -37,25 +37,22 @@ const html = createHTML_policy(window, '6').createHTML(INPUTS.HTML); const script = createScript_policy(window, '7').createScript(INPUTS.Script); - const xlinkNamespace = "http://www.w3.org/1999/xlink"; - const svgNamespace = "http://www.w3.org/2000/svg"; - // svg:script xlink:href=... expects a TrustedScriptURL. // Assigning a TrustedScriptURL works. test(t => { - let elem = document.createElementNS(svgNamespace, "script"); - elem.setAttributeNS(xlinkNamespace, "href", script_url); + let elem = document.createElementNS(NSURI_SVG, "script"); + elem.setAttributeNS(NSURI_XLINK, "href", script_url); assert_equals("" + RESULTS.ScriptURL, - elem.getAttributeNodeNS(xlinkNamespace, "href").value); + elem.getAttributeNodeNS(NSURI_XLINK, "href").value); }, "Assigning TrustedScriptURL to works"); // Assigning things that ought to not work. test(t => { - let elem = document.createElementNS(svgNamespace, "script"); + let elem = document.createElementNS(NSURI_SVG, "script"); const values = [ "abc", null, html, script ]; for (const v of values) { assert_throws_js(TypeError, _ => { - elem.setAttributeNS(xlinkNamespace, "href", v); + elem.setAttributeNS(NSURI_XLINK, "href", v); }); } }, "Blocking non-TrustedScriptURL assignment to works"); @@ -64,16 +61,16 @@ const nonLowerCaseTests = [ { element: "iframe", attribute: "SRCDOC", elementNamespace: htmlNamespace }, { element: "script", attribute: "SRC", elementNamespace: htmlNamespace }, - { element: "script", attribute: "HREF", elementNamespace: svgNamespace }, - { element: "script", attribute: "HREF", elementNamespace: svgNamespace, - attributeNamespace: xlinkNamespace }, + { element: "script", attribute: "HREF", elementNamespace: NSURI_SVG }, + { element: "script", attribute: "HREF", elementNamespace: NSURI_SVG, + attributeNamespace: NSURI_XLINK }, ]; for (const testData of nonLowerCaseTests) { const attributeNamespace = testData.attributeNamespace ?? null; test(t => { - assert_element_accepts_non_trusted_type_set_ns(testData.element, testData.attribute, "v", + assert_element_accepts_value_set_ns(testData.element, testData.attribute, "v", "v", testData.elementNamespace, attributeNamespace); }, "Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute \"" + testData.attribute + "\" (ns=" + attributeNamespace + ") for \"" + testData.element + diff --git a/trusted-types/support/helper.sub.js b/trusted-types/support/helper.sub.js index 1775cd985c24df..dcde42a1673415 100644 --- a/trusted-types/support/helper.sub.js +++ b/trusted-types/support/helper.sub.js @@ -158,7 +158,7 @@ function assert_throws_no_trusted_type_set_ns(tag, attribute, value) { }); } -function assert_element_accepts_non_trusted_type_set_ns(tag, attribute, value, expected, +function assert_element_accepts_value_set_ns(tag, attribute, value, expected, elementNamespace, attributeNamespace) { let elem = document.createElementNS(elementNamespace, tag); elem.setAttributeNS(attributeNamespace, attribute, value);