Make `webcomponents-loader.js` compatible with the Trusted Types API #501

bicknellr · 2022-03-31T00:10:02Z

Fixes https://github.com/Polymer/internal/issues/1272

…ted-types` option.

… writes a `<script>`. Not yet enforced.

bicknellr · 2022-03-31T00:16:27Z

Local WCT tests passed as expected, since no trusted types policy is being enforced yet:
https://github.com/webcomponents/polyfills/runs/5763342598?check_suite_focus=true#step:7:24

bicknellr · 2022-03-31T00:34:59Z

Hmm, I was expecting the last commit to start enforcing trusted types and cause the test to fail, but they passed:
https://github.com/webcomponents/polyfills/runs/5763527250?check_suite_focus=true#step:7:24

bicknellr · 2022-03-31T00:58:43Z

That test is now failing with a timeout, as expected:
https://github.com/webcomponents/polyfills/runs/5763712982?check_suite_focus=true#step:7:24

… the header without spaces in between.

bicknellr · 2022-03-31T01:05:54Z

After adding the new policy, the tests pass again:
https://github.com/webcomponents/polyfills/runs/5763782787?check_suite_focus=true#step:7:24

…a command line option.

…` policy isn't allowed.

… isn't available.

…er is enforcing trusted types.

bicknellr · 2022-04-07T00:07:48Z

packages/webcomponentsjs/webcomponents-loader.js

+      var trustedTypesAreEnforced = (() => {
+        try {
+          document.createElement('input').setAttribute('oninput', '');
+        } catch (e) {
+          return true;
+        }
+        return false;
+      })();
+
+      if (
+        window.trustedTypes &&
+        trustedTypesAreEnforced &&
+        !window.trustedTypes.isScriptURL(window.WebComponents.root)
+      ) {
+        throw new Error('`WebComponents.root` must be a `TrustedScriptURL`.');
+      }
+      url = trustedTypesPolicyWrapper.createScriptURL(
+        window.WebComponents.root + polyfillFile
+      );


@koto, I'm curious what you think about this w.r.t. w3c/trusted-types#36. The issue here is that WebComponents.root is arbitrary input used to build a string that I'm stamping here as a TrustedScriptURL, so I'd like to enforce that it is also a TrustedScriptURL. However, if I don't check for and enforce only at the same time as the browser, then this error would be thrown even if the browser is only reporting trusted type violations. Is there a better way to propagate enforcement like this?

We think it's an antipattern to change the behavior only if require-trusted-types-for (or any CSP directive, for that matter) is enforced. The issue with that is that report-only can't be safely used to iron out all the violations, and authors risk breaking production apps the moment enforcing CSP replaces the reporting one.

The safe (but breaking) route out of this is, I think, to introduce WebComponents.rootAsTrustedScriptURL (naming TBD) and use only that when window.trustedTypes is available.

The less-safe (but b/w compatible) is to continue using .root, and just documenting that the value should not be user controlled. To my understanding the loader is only used for polyfills anyway, and these would only be loaded for older browsers, which could only get TT via a polyfill, so the practical risk is minimal here.

I would personally just go for the second option, given the constraints.

Ok, yeah, the second option sounds best in this case since I don't think we'd want to make a breaking change to the loader at this point. Thanks for your input!

…nts.root` and the relevant tests.

…ted as a dangerous URL sink.

rictic · 2022-04-13T17:21:00Z

packages/webcomponentsjs/README.md

+bundle it selects based on feature detection. You should also treat
+`WebComponents.root` as if it were required to be set to a `TrustedScriptURL`
+when trusted types are being enforced.


Suggested change

bundle it selects based on feature detection. You should also treat

`WebComponents.root` as if it were required to be set to a `TrustedScriptURL`

when trusted types are being enforced.

bundle it selects based on feature detection. If you set `WebComponents.root`

(which is rare), it should be set to a TrustedScriptURL for Trusted Types

compatibility.

I'll work on the language more here. I don't think we can actually enforce that this is a TrustedScriptURL without making a breaking change, but I think I could word this so that the idea that it should only be set to values that would be considered as safe as a TrustedScriptURL was more clear. I.e. we can't actually enforce the safety ourselves, so users should know that it needs to be treated this way.

I've updated this slightly, PTAL

WDYT of this suggestion now?

Yeah, this is better - updated.

packages/webcomponentsjs/webcomponents-loader.js

wct-trusted-types-plugin/README.md

… if `WebComponents.root` is one also.

…d types are enforced. Co-authored-by: Peter Burns <[email protected]>

bicknellr · 2022-04-15T20:22:56Z

This is passing locally and in internal test runs so I'm going to merge despite the test infra problems.

bicknellr added 3 commits March 30, 2022 14:00

Add a new stub plugin.

3084ef2

Add trusted types headers to pages specified with the `--enforce-trus…

a884e86

…ted-types` option.

Add a test that checks that no errors occur when the loader creates /…

f211a10

… writes a `<script>`. Not yet enforced.

Start enforcing trusted types in the test document.

d822baa

Fix the path to the test where trusted types should be enforced.

fcfbfee

bicknellr added 3 commits March 30, 2022 17:59

Use a trusted types policy in webcomponents-loader.js where necessary.

4391104

Fix lint errors.

aec3926

Fix a bug in the plugin where multiple allowed policies were added to…

56142f4

… the header without spaces in between.

bicknellr added 17 commits March 30, 2022 18:19

Add a changelog entry in webcomponentsjs.

9eafd89

Use a query parameter to set the trusted types policies, rather than …

eac61a4

…a command line option.

Remove duplicate dependencies entry in the plugin's package.json.

920ffa7

Update package.json and package-lock.json.

534f376

Fix a lint error.

5ada29a

Move the trusted types tests to a new folder.

094fce1

Send a message when the test page catches an error.

c853a7f

Test that trusted type errors are thrown if the `webcomponents-loader…

b679302

…` policy isn't allowed.

Clean up the 'message' listeners after their tests.

111fa46

Rename test pages.

d95b9b2

loader-only-test-page.html -> loader-only-test-page_src-replace.html

7caa0ea

unused-policy-name -> 'none'

b265811

Test for compliance when setting WebComponents.root.

e41e65f

Enforce that WebComponents.root must be a TrustedScriptURL.

133b162

polyserve doesn't support ??=.

e9dcccf

Move delete statements to the top of the test files.

bf576f3

Skip some of the tests that don't make sense if the Trusted Types API…

d75f34e

… isn't available.

bicknellr force-pushed the loader-trusted-types branch from b867622 to 3e59faf Compare April 6, 2022 23:00

Only enforce that WebComponents.root is a trusted type if the brows…

2489843

…er is enforcing trusted types.

bicknellr force-pushed the loader-trusted-types branch from 3e59faf to 2489843 Compare April 6, 2022 23:04

bicknellr commented Apr 7, 2022

View reviewed changes

bicknellr added 5 commits April 11, 2022 14:36

Remove the check for Trusted Types enforcement when using `WebCompone…

5e84f1a

…nts.root` and the relevant tests.

Add documentation explaining that WebComponents.root should be trea…

2c1ce9e

…ted as a dangerous URL sink.

Rename some variables for clarity based on review feedback.

e06bccf

Add a comment explaining how the TrustedTypePolicy is used.

2e3f905

Add a README for the new WCT plugin.

1eda9d0

bicknellr force-pushed the loader-trusted-types branch from d0c4291 to 1eda9d0 Compare April 11, 2022 22:16

bicknellr requested a review from rictic April 11, 2022 22:55

bicknellr marked this pull request as ready for review April 11, 2022 22:55

bicknellr requested a review from aomarks as a code owner April 11, 2022 22:55

Merge remote-tracking branch 'origin/master' into loader-trusted-types

8532e0e

rictic requested changes Apr 13, 2022

View reviewed changes

bicknellr added 2 commits April 13, 2022 13:32

Remove wct-trusted-types-plugin.

d1748a1

Update documentation for WebComponents.root.

84549c5

bicknellr requested a review from rictic April 14, 2022 00:34

bicknellr and others added 3 commits April 14, 2022 15:29

When using WebComponents.root, only upgrade to a TrustedScriptURL…

f1fef5b

… if `WebComponents.root` is one also.

Docs: WebComponents.root should be a TrustedScriptURL when truste…

b5aeaac

…d types are enforced. Co-authored-by: Peter Burns <[email protected]>

Docs: Update the WebComponents.root section for clarity.

17aa2c7

rictic approved these changes Apr 15, 2022

View reviewed changes

bicknellr merged commit 34a104f into master Apr 15, 2022

bicknellr deleted the loader-trusted-types branch April 15, 2022 20:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Make `webcomponents-loader.js` compatible with the Trusted Types API #501

Make `webcomponents-loader.js` compatible with the Trusted Types API #501

Uh oh!

bicknellr commented Mar 31, 2022 •

edited

Loading

Uh oh!

bicknellr commented Mar 31, 2022 •

edited

Loading

Uh oh!

bicknellr commented Mar 31, 2022

Uh oh!

bicknellr commented Mar 31, 2022

Uh oh!

bicknellr commented Mar 31, 2022

Uh oh!

bicknellr Apr 7, 2022

Uh oh!

koto Apr 10, 2022

Uh oh!

bicknellr Apr 11, 2022

Uh oh!

rictic Apr 13, 2022

Uh oh!

bicknellr Apr 13, 2022

Uh oh!

bicknellr Apr 14, 2022

Uh oh!

rictic Apr 14, 2022 •

edited

Loading

Uh oh!

bicknellr Apr 15, 2022

Uh oh!

Uh oh!

Uh oh!

bicknellr commented Apr 15, 2022

Uh oh!

Uh oh!

Make webcomponents-loader.js compatible with the Trusted Types API #501

Make webcomponents-loader.js compatible with the Trusted Types API #501

Uh oh!

Conversation

bicknellr commented Mar 31, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bicknellr commented Mar 31, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bicknellr commented Mar 31, 2022

Uh oh!

bicknellr commented Mar 31, 2022

Uh oh!

bicknellr commented Mar 31, 2022

Uh oh!

bicknellr Apr 7, 2022

Choose a reason for hiding this comment

Uh oh!

koto Apr 10, 2022

Choose a reason for hiding this comment

Uh oh!

bicknellr Apr 11, 2022

Choose a reason for hiding this comment

Uh oh!

rictic Apr 13, 2022

Choose a reason for hiding this comment

Uh oh!

bicknellr Apr 13, 2022

Choose a reason for hiding this comment

Uh oh!

bicknellr Apr 14, 2022

Choose a reason for hiding this comment

Uh oh!

rictic Apr 14, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bicknellr Apr 15, 2022

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bicknellr commented Apr 15, 2022

Uh oh!

Uh oh!

Make `webcomponents-loader.js` compatible with the Trusted Types API #501

Make `webcomponents-loader.js` compatible with the Trusted Types API #501

bicknellr commented Mar 31, 2022 •

edited

Loading

bicknellr commented Mar 31, 2022 •

edited

Loading

rictic Apr 14, 2022 •

edited

Loading