[WebAPI] Implement Trusted Types support for `document.write()`/`document.writeln()`

[Rumyra]

Acceptance criteria

• The listed features are documented sufficiently on MDN
• BCD is updated
• Interactive example and data repos are updated if appropriate
• The content has been reviewed as needed

For folks helping with Firefox related documentation

• Set bugs to dev-doc-complete
• Add entry to Firefox release notes for enabled/preview features
• Add/remove entry to Firefox experimental features page for preference/released features

Related Gecko bugs

• https://bugzilla.mozilla.org/show_bug.cgi?id=1906301 - Implement Trusted Types support for document.write()/document.writeln() - 135
  • BCD updated
  • Docs
• https://bugzilla.mozilla.org/show_bug.cgi?id=1905706 - HTMLScriptElement attr src/innerText/textContent/text - 135
  • BCD updated
  • Docs
    • HTMLScriptElement.text - trustedTypes for scripts #41128
    • src/innerText/textContent
• https://bugzilla.mozilla.org/show_bug.cgi?id=1931290 - Window.setInterval()/setTimeout()
  • BCD updated
  • Docs

These ones for 136

• https://bugzilla.mozilla.org/show_bug.cgi?id=1940049 SVGAnimatedString.baseVal
  • BCD Add Trusted Types subfeatures to various APIs browser-compat-data#27836
  • Docs
• https://bugzilla.mozilla.org/show_bug.cgi?id=1931293 WorkerGlobalScope.importScripts()
  • BCD Add Trusted Types subfeatures to various APIs browser-compat-data#27836
  • Docs
• https://bugzilla.mozilla.org/show_bug.cgi?id=1940044 ServiceWorkerContainer.register() - TrustedScriptURL
  • BCD Add Trusted Types subfeatures to various APIs browser-compat-data#27836
  • Docs

Note these ones for 137

• https://bugzilla.mozilla.org/show_bug.cgi?id=1944504 onmessage and onreadystatechange attributes - not sure what this means. Asking in https://bugzilla.mozilla.org/show_bug.cgi?id=1944504#c8
  • BCD
  • Docs

These for 138

• https://bugzilla.mozilla.org/show_bug.cgi?id=1942306 Content-Security-Policy: trusted-types - support for setting the allowed trusted type policy names
  • BCD Add Trusted Types subfeatures to various APIs browser-compat-data#27836
  • Docs - Already OK

These for 144

• https://bugzilla.mozilla.org/show_bug.cgi?id=1928932 - CSP enforcement - I THINK see https://bugzilla.mozilla.org/show_bug.cgi?id=1928932#c21

Other

• Check content open issues to see if any pertain to the subject matter. If there are any that can be closed because of the work, do so. If there are any that can be fixed relatively quickly because of the knowledge from completing this issue and you have time, feel free to go ahead and fix them.

[hamishwillee]

This is one of many features behind dom.security.trusted_types.enabled. Note, this is not ready for testing, so have not added note in Release note.

Note, whole API ready for testing when https://bugzilla.mozilla.org/show_bug.cgi?id=1939805 resolves, according to Frederik Baum in https://bugzilla.mozilla.org/show_bug.cgi?id=1916957#c4

But it shows a lot of the docs in the area don't know about injection sinks, so quite a lot of work to be done in this API.

Status

• BCD Trusted Types - FF updates and missing entries in TT spec browser-compat-data#25839

• Docs

  • TrustedHTML

    • Document: parseHTMLUnsafe() - TrustedTypes: Add boilerplate for the xxxHtmlUnsafe() methods #40420
    • Document.write() - TrustedTypes injection - Document.write() and Document.writeln() #37952
    • Document.writeln() - TrustedTypes injection - Document.write() and Document.writeln() #37952
    • DOMParser.parseFromString()
    • Element.innerHTML - Element.innerHTML - add info trusted types #40423
    • Element.insertAdjacentHTML Element.innerHTML - add info trusted types #40423
    • Element.outerHTML - Element.outerHTML and TrustedTypes #40633
    • Element.setHTMLUnsafe() - TrustedTypes: Add boilerplate for the xxxHtmlUnsafe() methods #40420
    • HTMLIFrameElement.srcdoc
    • Range.createContextualFragment()
    • ShadowRoot.innerHTML - ShadowRoot.innerHTML - update to support TrustedHTML #40790
    • ShadowRoot.setHTMLUnsafe() TrustedTypes: Add boilerplate for the xxxHtmlUnsafe() methods #40420

  • TrustedScript

    • HTMLScriptElement.innerText - note, this is on HTMLElement/innerText
    • Node.textContent
      • HTMLScriptElement.textContent - inherited from Node/textContent
    • HTMLScriptElement.text HTMLScriptElement.text - trustedTypes for scripts #41128
    • window.setTimeout() - code param
    • window.setInterval() code param

  • TrustedScriptURL

    • HTMLScriptElement.src

  • More from Luke Missing Trusted Type support data for various sinks browser-compat-data#26242 (comment) (current set at time of writing that don't have BCD entries, and hence aren't listed above)

    • document.execCommand()
    • svgAnimatedString.baseVal - This always accepts TrustedScriptURL but it only enforces TT when it's SVGScriptElement.href.baseVal (though actually in Chrome it is incorrectly enforced when SVGScriptElement.className.baseVal)
    • serviceWorkerContainer.register()
    • worker.importScripts()
    • new Worker()
    • new SharedWorker()
    • HTMLEmbedElement.src - no longer needed by the spec and as such NOT implemented in WebKit (probably doesn't need documenting) ..
    • HTMLObjectElement.data - no longer needed by the spec and as such NOT implemented in WebKit (probably doesn't need documenting)
    • object.codeBase - not documented on MDN, no longer needed by the spec and as such NOT implemented in WebKit (probably doesn't need documenting)
    • Chromium also erroneously accepts TrustedScript (and enforces TT) on before(), after(), replaceWith(), prepend(), append() and replaceChildren() when called on HTMLScriptElements. There's also some general coverage on both HTMLScriptElement and SVGScriptElement when their contents are updated not via an approved sink (in the case of SVG there is no approved sink so their content is only trusted via the parser).

• Release note - May not be needed. Checking https://bugzilla.mozilla.org/show_bug.cgi?id=1916957#c3

• Experimental features - FF135 ExprFeatures - Add trusted types #37926

• dev-doc-complete

[wbamberg]

From Aaron, putting this here for future reference:

list of all Trusted Types sinks-- currently, the best close-to-source-of-truth is calling self.trustedTypes.getTypeMapping() which kinda only works in Chromium (and is missing a couple edge cases of weirdly behaving sinks like execCommand).

Ideally, we should have this as a part of the HTML spec but there are some... documentation auto-generation difficulties currently in the way of auto-generating appendices for sinks that lead to TT enforcement.

Another source of truth (partially linked to trustedTypes.getTypeMapping() in Chromium) is the IDL definitions in the Chromium codebase for which sinks are gated by TT

We also have Luke's PR at mdn/browser-compat-data#26242.