Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Don't stringify DOM attributes #19588

Closed
wants to merge 5 commits into from
Closed

Don't stringify DOM attributes #19588

wants to merge 5 commits into from

Commits on Jun 15, 2021

  1. Gate attribute stringification on bug detection logic (IE<=9 does not… 

    … stringify attributes), instead of Trusted Types feature flag.

Added fixture tests for the logic.

For attributes undergoing sanitizeURL, the value is stringified in sanitizeURL function, unless enableTrustedTypesIntegration is true and the value is and immutable TrustedScriptURL value. This ascertains that objects with custom toString() function cannot be used to bypass the sanitization (now that DOMPropertyOperations don't stringify on their own).

Fixes facebook#19587.
    @koto
    koto committed Jun 15, 2021
    Configuration menu
    Copy the full SHA
    064319e View commit details
    Browse the repository at this point in the history

  2. Fix the stringification test for IE9 - an existing attribute name mus… 

    …t be used.
    @koto
    koto committed Jun 15, 2021
    Configuration menu
    Copy the full SHA
    9675d5e View commit details
    Browse the repository at this point in the history

  3. Empty commit to replace "broken" head of main 

    Head commit had a "broken" (but not really) CircleCI job and CircleCI
doesn't give me a way to clear/restart it. So I'm doing this.
    @acdlite @koto
    acdlite authored and koto committed Jun 15, 2021
    Configuration menu
    Copy the full SHA
    b60f488 View commit details
    Browse the repository at this point in the history

  4. Trigger Build

    @rickhanlonii @koto
    rickhanlonii authored and koto committed Jun 15, 2021
    Configuration menu
    Copy the full SHA
    85f1122 View commit details
    Browse the repository at this point in the history

  5. Removed IE9 workaround. Now we assume Node.setAttribute(NS) stringifies.

    @koto
    koto committed Jun 15, 2021
    Configuration menu
    Copy the full SHA
    5f414e7 View commit details
    Browse the repository at this point in the history