Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Event handler enforcement section wrong #474

Open
lukewarlow opened this issue Mar 13, 2024 · 1 comment
Open

Event handler enforcement section wrong #474

lukewarlow opened this issue Mar 13, 2024 · 1 comment
Assignees
Milestone

Comments

@lukewarlow
Copy link
Member

In the enforcement in event handler content attributes the sink name as specified does not match the rest of the spec.

sink being the result of concatenating the list « element’s local name, localName » with "." as a separator.

NOTE: For example, document.createElement('div').onclick = value will result in sink being 'div.onclick'.

The note is wrong because el.onclick = 'string' wont trigger a violation. But also the sink value here doesn't match anywhere else in the spec. I would expect Element onclick personally?

@lukewarlow lukewarlow added this to the v1 milestone Mar 14, 2024
@lukewarlow
Copy link
Member Author

Okay so after doing some more digging I think this section needs removing entirely and https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation needs updating to account for event handler attributes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants