Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DOM properties should be configurable by default #171

Open
Siegrift opened this issue Oct 26, 2020 · 0 comments
Open

DOM properties should be configurable by default #171

Siegrift opened this issue Oct 26, 2020 · 0 comments

Comments

@Siegrift
Copy link

Hi,

I am working on Trusted Types (TT) polyfill which is a new API proposal for mitigating client side DOM XSS by changing the definition of dangerous DOM APIs, called "sinks".

The polyfill works by re-defining the sinks. This works for native DOM API, because properties on the DOM are configurable (see configurable section in Object.defineProperty).

I am working on an example integration of TT polyfill with domino. You can see the preliminary PR in w3c/trusted-types#299. Unfortunately, properties created by domino are non-configurable (e.g. insertAdjacentHTML) and the polyfill code breaks.

I saw a similar (closed) issue #89, for writable properties. This is a bit similar. What I propose is making the properties configurable by default. If there are no objections, I think I should have time to create a PR for this.

cc: @koto

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant