[Webkit-unassigned] [Bug 275352] New: Remove Trusted Types enforcement from toggleAttribute

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=275352

            Bug ID: 275352
           Summary: Remove Trusted Types enforcement from toggleAttribute
           Product: WebKit
           Version: Safari 17
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: DOM
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: lwarlow at igalia.com

Based on discussions with the chromium folks it turns out the enforcement inside of toggleAttribute was an accidental implementation bug rather than intentional (the integration with DOM was underspecified so the spec originally worked off of the chrome implementation). Based on this and the fact that toggling an attribute isn't an XSS vulnerability, the spec PR https://github.com/whatwg/dom/pull/1268 has been updated to not include this enforcement.

This bug tracks removing it from WebKit.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240611/e1752aac/attachment.htm>