[WebAPI] Implement Trusted Types support for `document.write()`/`document.writeln()`

[Rumyra]

Acceptance criteria

• The listed features are documented sufficiently on MDN
• BCD is updated
• Interactive example and data repos are updated if appropriate
• The content has been reviewed as needed

For folks helping with Firefox related documentation

• Set bugs to dev-doc-complete
• Add entry to Firefox release notes for enabled/preview features
• Add/remove entry to Firefox experimental features page for preference/released features

Related Gecko bugs

• https://bugzilla.mozilla.org/show_bug.cgi?id=1906301 - Implement Trusted Types support for document.write()/document.writeln() - 135
  • BCD updated
  • Docs
• https://bugzilla.mozilla.org/show_bug.cgi?id=1905706 - HTMLScriptElement attr src/innerText/textContent/text - 135
  • BCD updated
  • Docs
    • HTMLScriptElement.text - trustedTypes for scripts #41128
    • src/innerText/textContent
• https://bugzilla.mozilla.org/show_bug.cgi?id=1931290 - Window.setInterval()/setTimeout()
  • BCD updated
  • Docs
    • WorkerGlobalScope.setInterval() - update for trusted types #42042
    • setTimeout() on Window/Worker plus consistency fixes #42072

These ones for 136

• https://bugzilla.mozilla.org/show_bug.cgi?id=1940049 SVGAnimatedString.baseVal
  • BCD Add Trusted Types subfeatures to various APIs browser-compat-data#27836
  • Docs TrustedTypes: SVGAnimatedString.baseVal #42502
• https://bugzilla.mozilla.org/show_bug.cgi?id=1931293 WorkerGlobalScope.importScripts()
  • BCD Add Trusted Types subfeatures to various APIs browser-compat-data#27836
  • Docs TrustedTypes: WorkerGlobalScope: importScripts() #42396
• https://bugzilla.mozilla.org/show_bug.cgi?id=1940044 ServiceWorkerContainer.register() - TrustedScriptURL
  • BCD Add Trusted Types subfeatures to various APIs browser-compat-data#27836
  • Docs Trusted Types: ServiceWorkerContainer.register() #42362

Note these ones for 137

• https://bugzilla.mozilla.org/show_bug.cgi?id=1944504 onmessage and onreadystatechange attributes - not sure what this means. Asking in https://bugzilla.mozilla.org/show_bug.cgi?id=1944504#c8
  • BCD
  • Docs

These for 138

• https://bugzilla.mozilla.org/show_bug.cgi?id=1942306 Content-Security-Policy: trusted-types - support for setting the allowed trusted type policy names
  • BCD Add Trusted Types subfeatures to various APIs browser-compat-data#27836
  • Docs - Already OK

These for 144

• https://bugzilla.mozilla.org/show_bug.cgi?id=1928932 see https://bugzilla.mozilla.org/show_bug.cgi?id=1928932#c21. If CSP enabled, this - done in TrustedTypes: Indirect sinks #42638
  • enforces TT for assignment of script to text -

    let script = document.createElement("script");
    script.text = "/* arbitrary JS code */"; 

  • Check at the script execution part for cases where script is about to be executed because there are cases other than direct assignment of text, where the API does not lend itself to TT (read above link). I think action here is to update TT docs to make it clear these kinds of check exist.

    let script = document.createElement("script");
    script.appendChild(document.createTextNode("/* arbitrary JS code */"));
    document.body.appendChild(script);

Other

• Check content open issues to see if any pertain to the subject matter. If there are any that can be closed because of the work, do so. If there are any that can be fixed relatively quickly because of the knowledge from completing this issue and you have time, feel free to go ahead and fix them.

[hamishwillee]

This is one of many features behind dom.security.trusted_types.enabled. Note, this is not ready for testing, so have not added note in Release note.

Note, whole API ready for testing when https://bugzilla.mozilla.org/show_bug.cgi?id=1939805 resolves, according to Frederik Baum in https://bugzilla.mozilla.org/show_bug.cgi?id=1916957#c4

But it shows a lot of the docs in the area don't know about injection sinks, so quite a lot of work to be done in this API.

Status

• BCD Trusted Types - FF updates and missing entries in TT spec browser-compat-data#25839

• Docs

  • TrustedHTML

    • Document: parseHTMLUnsafe() - TrustedTypes: Add boilerplate for the xxxHtmlUnsafe() methods #40420
    • Document.write() - TrustedTypes injection - Document.write() and Document.writeln() #37952
    • Document.writeln() - TrustedTypes injection - Document.write() and Document.writeln() #37952
    • DOMParser.parseFromString() DocParser.parseFromString() - update for trusted types #41490
    • Element.innerHTML - Element.innerHTML - add info trusted types #40423
    • Element.insertAdjacentHTML Element.innerHTML - add info trusted types #40423
    • Element.outerHTML - Element.outerHTML and TrustedTypes #40633
    • Element.setHTMLUnsafe() - TrustedTypes: Add boilerplate for the xxxHtmlUnsafe() methods #40420
    • HTMLIFrameElement.srcdoc HTMLIFrameElement.srcdoc - takes trusted types #41459
    • Range.createContextualFragment() TrustedTypes: Range.createContextualFragment() #42493
    • ShadowRoot.innerHTML - ShadowRoot.innerHTML - update to support TrustedHTML #40790
    • ShadowRoot.setHTMLUnsafe() TrustedTypes: Add boilerplate for the xxxHtmlUnsafe() methods #40420

  • TrustedScript

    • HTMLScriptElement.innerText - note, this is on HTMLElement/innerText - HTMLScriptElement.textContent/innerText - docs for TrustedTypes #41341
    • Node.textContent and HTMLScriptElement.textContent - HTMLScriptElement.textContent/innerText - docs for TrustedTypes #41341
    • HTMLScriptElement.text HTMLScriptElement.text - trustedTypes for scripts #41128
    • window.setTimeout() - code param setInterval(code) - update with TrustedScript #41403
    • window.setInterval() code param - setInterval(code) - update with TrustedScript #41403

  • TrustedScriptURL

    • HTMLScriptElement.src HTMLScriptElement.src - update for TrustedScriptURL #41413

  • More from Luke Missing Trusted Type support data for various sinks browser-compat-data#26242 (comment) (current set at time of writing that don't have BCD entries, and hence aren't listed above)

    • document.execCommand() TrustedTypes: Document.execCommand() with command insertHTML #42238
    • svgAnimatedString.baseVal - TrustedTypes: SVGAnimatedString.baseVal #42502
    • serviceWorkerContainer.register() Trusted Types: ServiceWorkerContainer.register() #42362
    • worker.importScripts() TrustedTypes: WorkerGlobalScope: importScripts() #42396
    • new Worker() TrustedTypes: Worker()/SharedWorker() constructors #42073
    • new SharedWorker() TrustedTypes: Worker()/SharedWorker() constructors #42073
    • HTMLEmbedElement.src - no longer needed by the spec and as such NOT implemented in WebKit (probably doesn't need documenting) ..
    • HTMLObjectElement.data - no longer needed by the spec and as such NOT implemented in WebKit (probably doesn't need documenting)
    • object.codeBase - not documented on MDN, no longer needed by the spec and as such NOT implemented in WebKit (probably doesn't need documenting)
    • Chromium also erroneously accepts TrustedScript (and enforces TT) on before(), after(), replaceWith(), prepend(), append() and replaceChildren() when called on HTMLScriptElements. There's also some general coverage on both HTMLScriptElement and SVGScriptElement when their contents are updated not via an approved sink (in the case of SVG there is no approved sink so their content is only trusted via the parser).

• Release note - May not be needed. Checking https://bugzilla.mozilla.org/show_bug.cgi?id=1916957#c3

• Experimental features - FF135 ExprFeatures - Add trusted types #37926

• dev-doc-complete

[wbamberg]

From Aaron, putting this here for future reference:

list of all Trusted Types sinks-- currently, the best close-to-source-of-truth is calling self.trustedTypes.getTypeMapping() which kinda only works in Chromium (and is missing a couple edge cases of weirdly behaving sinks like execCommand).

Ideally, we should have this as a part of the HTML spec but there are some... documentation auto-generation difficulties currently in the way of auto-generating appendices for sinks that lead to TT enforcement.

Another source of truth (partially linked to trustedTypes.getTypeMapping() in Chromium) is the IDL definitions in the Chromium codebase for which sinks are gated by TT

We also have Luke's PR at mdn/browser-compat-data#26242.