Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SVGAnimatedString erroneously invokes Trusted Types for SVGScriptElement.className.baseVal #963

Open
lukewarlow opened this issue Jan 7, 2025 · 1 comment

Comments

@lukewarlow
Copy link
Member

SVGScriptElement can have SVGAnimatedString properties other than href and actually I believe className is the only one.

As I read the current text, Get Trusted Type compliant string will be executed with the 'SVGScriptElement href' when one tries to set SVGScriptElement.className to a plain string, but we probably just want to use the specified value in that case.

I added more tests in to cover this (as well as href on non-script elements) where we don't want to run the TT checks: https://phabricator.services.mozilla.com/D233341. Luckily, Gecko implements SVGAnimatedString for className in a separate C++ class so it's easy to make the test pass, but I don't know whether the checking the reflected attribute name is straightforward in other engines...

Chromium fails for "Assign string to SVGScriptElement.className.baseVal.", so it indeed executes the trusted type check for class name.

Originally posted by @fred-wang in #961 (comment)

@lukewarlow
Copy link
Member Author

This is a spec bug and impl bug in Chromium (and WebKit but I can fix that), and we should fix this.

cc @otherdaniel for Chromium side.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant