Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Trusted Types support to CSP Embedded Enforcement #29

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

shhnjk
Copy link
Member

@shhnjk shhnjk commented Mar 15, 2024

This change adds Trusted Types support to Embedded Enforcement.

Fixes: w3c/webappsec-csp#628

@shhnjk
Copy link
Member Author

shhnjk commented Mar 15, 2024

@antosart, PTAL! Thanks!

@antosart
Copy link
Member

I'm not sure this is enough. This change makes the effective directive value for name and policy return non-null. The subsumption algorithm though basically only implements the case in which the directive value is a source list (in fact there are a series of TODOs for 'frame-ancestors', 'plugin-types' an 'sandbox').

I guess you would need to specify how subsumption is supposed to work for trusted types policies. Actually, I believe some minimal amount of work would be needed also for the intersection algorithm which has the same problem.

(A not aside: I think this spec does not autobuild, so you have to generate the index.html within the PR.)

@tosmolka
Copy link

@antosart , @shhnjk , any updates on this one? If we need changes to subsumption and intersection algorithms for trusted types policies, is this something you plan to do? Just trying to understand the current state. Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CSP:EE does not support Trusted Types CSP directives
3 participants