Add Trusted Types subfeatures to various APIs #27836

hamishwillee · 2025-09-12T04:23:19Z

This adds Trusted Type info for a number of API. I am working of Firefox. Where possible I have attempted to determine Chrome and Safari data. Where not found I have marked as false. Supporting data for each case linked inline.

APIs added

SVGAnimatedString.baseVal - TrustedScriptURL
WorkerGlobalScope.importScripts() - TrustedScriptURL
ServiceWorkerContainer.register() - TrustedScriptURL
Content-Security-Policy: trusted-types - support for setting the allowed trusted type policy names

hamishwillee · 2025-09-12T04:23:35Z

api/SVGAnimatedString.json

+              "chrome_android": "mirror",
+              "edge": "mirror",
+              "firefox": {
+                "version_added": "136",


From https://bugzilla.mozilla.org/show_bug.cgi?id=1940049

github-actions · 2025-09-12T04:23:54Z

Tip: Review these changes grouped by change (recommended for most PRs), or grouped by feature (for large PRs).

hamishwillee · 2025-09-12T04:24:01Z

api/SVGAnimatedString.json

+            "description": "Requires `TrustedScriptURL` instance when trusted types are enforced",
+            "support": {
+              "chrome": {
+                "version_added": "141"


From https://chromiumdash.appspot.com/commit/ab114f7af38648bd48ce2faeb8d6759bb479b1dd.

hamishwillee · 2025-09-12T04:24:31Z

api/SVGAnimatedString.json

+        },
+        "enforces_trusted_types": {
+          "__compat": {
+            "description": "Requires `TrustedScriptURL` instance when trusted types are enforced",


Note, no spec url. Spec update in w3c/svgwg#934 but seems to be no corresponding online link.

FYI there should be a web-type but following previous direction leaving it to BCD team to update.

hamishwillee · 2025-09-12T04:27:44Z

api/SVGAnimatedString.json

+              "opera": "mirror",
+              "opera_android": "mirror",
+              "safari": {
+                "version_added": false


Can't find evidence for Safari. Likely is supported as it has pretty good coverage on WPT, but there is not WPT test for this.

hamishwillee · 2025-09-12T05:17:48Z

api/WorkerGlobalScope.json

+              "chrome_android": "mirror",
+              "edge": "mirror",
+              "firefox": {
+                "version_added": "136",


From https://bugzilla.mozilla.org/show_bug.cgi?id=1931293

hamishwillee · 2025-09-12T05:19:54Z

api/WorkerGlobalScope.json

+              "opera": "mirror",
+              "opera_android": "mirror",
+              "safari": {
+                "version_added": "26"


This is from running just one of the importScript tests (https://wpt.live/trusted-types/DedicatedWorker-importScripts.html) on the latest Safari on browserstack. The next earliest version is 18 AFAIK and it didn't run on that.

api/WorkerGlobalScope.json

hamishwillee · 2025-09-12T05:55:13Z

api/ServiceWorkerContainer.json

+              "chrome_android": "mirror",
+              "edge": "mirror",
+              "firefox": {
+                "version_added": "136",


In https://bugzilla.mozilla.org/show_bug.cgi?id=1940044

hamishwillee · 2025-09-12T05:56:55Z

api/ServiceWorkerContainer.json

+            "description": "`scriptURL` parameter requires `TrustedScriptURL` instance when trusted types are enforced",
+            "support": {
+              "chrome": {
+                "version_added": "140"


So this is from https://issues.chromium.org/issues/330516530#comment25 which LOOKs to be related. Traced that to v140 via https://chromiumdash.appspot.com/commits?commit=882e7efd3bffedad411e53beed79a2f3e8e335e9&platform=Android

Note, the tests https://wpt.live/trusted-types/ (that include register) pass for many versions, so are not a good indicator of support

hamishwillee · 2025-09-12T05:57:45Z

api/ServiceWorkerContainer.json

+              "opera": "mirror",
+              "opera_android": "mirror",
+              "safari": {
+                "version_added": "26"


This is the first version on browserstack that understands trusted types (at all). It passes the register tests in https://wpt.live/trusted-types/ but as above I don't have great faith in these.

hamishwillee · 2025-09-12T06:24:37Z

http/headers/Content-Security-Policy.json

              "firefox": {
-                "version_added": false,
-                "impl_url": "https://bugzil.la/1508286"
+                "version_added": "138",


From https://bugzilla.mozilla.org/show_bug.cgi?id=1942306 .

hamishwillee · 2025-09-15T02:23:20Z

http/headers/Content-Security-Policy.json

              "firefox": {
-                "version_added": false,
-                "impl_url": "https://bugzil.la/1508286"
+                "version_added": "135",


This is require-trusted-types-for.
This was implemented in https://bugzilla.mozilla.org/show_bug.cgi?id=1905678 but as noted in https://bugzilla.mozilla.org/show_bug.cgi?id=1905678#c1 this is "honored" in a number of other issues. The first of those is https://bugzilla.mozilla.org/show_bug.cgi?id=1905706 which delivered in 135.

Technically this is a partial implementation since enforcement will not enforce everything. But that has more to do with the things to be enforced still rolling out. Since at the end it will all be implemented, I think it makes sense to treat this part of the story (the directive) as fully implemented behind flag.

caugner

LGTM overall, just one case where I found a different Chrome version.

api/WorkerGlobalScope.json

Co-authored-by: Claas Augner <[email protected]>

hamishwillee · 2025-09-16T21:24:53Z

Thanks. Trust your research more than mine.

api/ServiceWorkerContainer.json

SVGAnimatedString.baseVal - TT support

c7835f9

github-actions bot added the data:api Compat data for Web APIs. https://developer.mozilla.org/docs/Web/API label Sep 12, 2025