You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
SVGScriptElement can have SVGAnimatedString properties other than href and actually I believe className is the only one.
As I read the current text, Get Trusted Type compliant string will be executed with the 'SVGScriptElement href' when one tries to set SVGScriptElement.className to a plain string, but we probably just want to use the specified value in that case.
I added more tests in to cover this (as well as href on non-script elements) where we don't want to run the TT checks: https://phabricator.services.mozilla.com/D233341. Luckily, Gecko implements SVGAnimatedString for className in a separate C++ class so it's easy to make the test pass, but I don't know whether the checking the reflected attribute name is straightforward in other engines...
Chromium fails for "Assign string to SVGScriptElement.className.baseVal.", so it indeed executes the trusted type check for class name.
SVGScriptElement
can haveSVGAnimatedString
properties other thanhref
and actually I believeclassName
is the only one.As I read the current text,
Get Trusted Type compliant string
will be executed with the 'SVGScriptElement href' when one tries to setSVGScriptElement.className
to a plain string, but we probably just want to use the specified value in that case.I added more tests in to cover this (as well as href on non-script elements) where we don't want to run the TT checks: https://phabricator.services.mozilla.com/D233341. Luckily, Gecko implements
SVGAnimatedString
forclassName
in a separate C++ class so it's easy to make the test pass, but I don't know whether the checking the reflected attribute name is straightforward in other engines...Chromium fails for "Assign string to SVGScriptElement.className.baseVal.", so it indeed executes the trusted type check for class name.
Originally posted by @fred-wang in #961 (comment)
The text was updated successfully, but these errors were encountered: