Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Trusted Types: Prototype for hacking. #6457

Conversation

chromium-wpt-export-bot
Copy link
Collaborator

@chromium-wpt-export-bot chromium-wpt-export-bot commented Jul 4, 2017

After talking with some folks about xtof's 1, I think there's something
there that browsers are uniquely positioned to help out with. This patch
starts sketching out what a set of safe types might look like, and what
it might feel like for a developer to lock themselves out of raw string
assignments to typical XSS sinks like location.href or el.innerHTML.

This patch implements a first pass at TrustedHTML and TrustedURL,
along with updates to a few sinks to use these new types. It's by no
means a complete implementation, but should give us enough to play
around with while we experiment with library authors to see how the
layering might work.

Explainer: https://github.com/mikewest/trusted-types
Intent to Implement: https://groups.google.com/a/chromium.org/d/msg/blink-dev/qbOrXp9g3B8/hziymUnHAQAJ

P.S. This patch looks huge and ugly, but the majority of the changes are
the renamings of set{Inner,Outer}HTML that touch a million tests.

Bug: 739170
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I65e5add5cc7fcbc17f97ca8b737d7a3e1d8cad3b
Reviewed-on: https://chromium-review.googlesource.com/559061
Commit-Queue: Mike West mkwst@chromium.org
Reviewed-by: Yoav Weiss yoav@yoav.ws
Cr-Commit-Position: refs/heads/master@{#503113}

Copy link
Collaborator

@wpt-pr-bot wpt-pr-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Already reviewed downstream.

@w3c-bots
Copy link

w3c-bots commented Jul 4, 2017

View the complete job log.

Firefox (nightly)

Testing web-platform-tests at revision 048d9c4
Using browser at version BuildID 20170704100254; SourceStamp fef489e8c2a193dde885adc48deb74cc883a5881
Starting 10 test iterations
All results were stable

All results

11 tests ran
/safe-html-types/SafeHTML.tentative.html
Subtest Results Messages
OK
Basic escaping. FAIL SafeHTML is not defined
Basic unsafe construction. FAIL SafeHTML is not defined
/safe-html-types/SafeURL.tentative.html
Subtest Results Messages
OK
Basic processing: safe URL, safe construction. FAIL SafeURL is not defined
Basic processing: safe URL, unsafe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, safe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, unsafe construction. FAIL SafeURL is not defined
Basic processing: external protocol URL, safe construction. FAIL SafeURL is not defined
Basic processing: external protocol URL, unsafe construction. FAIL SafeURL is not defined
/safe-html-types/block-string-assignment-to-innerHTML.tentative.html
Subtest Results Messages
OK
innerHTML = string throws. FAIL assert_throws: function "_ => {\n d.innerHTML = "Fail.";\n }" did not throw
innerHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
innerHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/block-string-assignment-to-insertAdjacentHTML.tentative.html
Subtest Results Messages
OK
insertAdjacentHTML(string) throws. FAIL assert_throws: function "_ => {\n d.insertAdjacentHTML('beforebegin', "<p>Fail</p>");\n }" did not throw
insertAdjacentHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
insertAdjacentHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/block-string-assignment-to-location-href.tentative.html
Subtest Results Messages
OK
location.href = string throws FAIL SafeURL is not defined
Basic processing: safe URL, safe construction. FAIL SafeURL is not defined
Basic processing: safe URL, unsafe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, safe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, unsafe construction. FAIL SafeURL is not defined
/safe-html-types/block-string-assignment-to-outerHTML.tentative.html
Subtest Results Messages
OK
outerHTML = string throws. FAIL assert_throws: function "_ => {\n d.outerHTML = "Fail.";\n }" did not throw
outerHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
outerHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/document-write.tentative.html
Subtest Results Messages
OK
document.write(SafeHTML). FAIL SafeHTML is not defined
/safe-html-types/innerHTML.tentative.html
Subtest Results Messages
OK
innerHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
innerHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/insertAdjacentHTML.tentative.html
Subtest Results Messages
OK
insertAdjacentHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
insertAdjacentHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/location-href.tentative.html
Subtest Results Messages
OK
Basic processing: safe URL, safe construction. FAIL SafeURL is not defined
Basic processing: safe URL, unsafe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, safe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, unsafe construction. FAIL SafeURL is not defined
/safe-html-types/outerHTML.tentative.html
Subtest Results Messages
OK
outerHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
outerHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
@w3c-bots
Copy link

w3c-bots commented Jul 4, 2017

View the complete job log.

Sauce (safari)

Testing web-platform-tests at revision 048d9c4
Using browser at version 10.0
Starting 10 test iterations
All results were stable

All results

11 tests ran
/safe-html-types/SafeHTML.tentative.html
Subtest Results Messages
OK
Basic escaping. FAIL Can't find variable: SafeHTML
Basic unsafe construction. FAIL Can't find variable: SafeHTML
/safe-html-types/SafeURL.tentative.html
Subtest Results Messages
OK
Basic processing: safe URL, safe construction. FAIL Can't find variable: SafeURL
Basic processing: safe URL, unsafe construction. FAIL Can't find variable: SafeURL
Basic processing: javascript URL, safe construction. FAIL Can't find variable: SafeURL
Basic processing: javascript URL, unsafe construction. FAIL Can't find variable: SafeURL
Basic processing: external protocol URL, safe construction. FAIL Can't find variable: SafeURL
Basic processing: external protocol URL, unsafe construction. FAIL Can't find variable: SafeURL
/safe-html-types/block-string-assignment-to-innerHTML.tentative.html
Subtest Results Messages
OK
innerHTML = string throws. FAIL assert_throws: function "_ => {\n d.innerHTML = "Fail.";\n }" did not throw
innerHTML = SafeHTML.escape(). FAIL Can't find variable: SafeHTML
innerHTML = SafeHTML.unsafelyCreate(). FAIL Can't find variable: SafeHTML
/safe-html-types/block-string-assignment-to-insertAdjacentHTML.tentative.html
Subtest Results Messages
OK
insertAdjacentHTML(string) throws. FAIL assert_throws: function "_ => {\n d.insertAdjacentHTML('beforebegin', "<p>Fail</p>");\n }" did not throw
insertAdjacentHTML = SafeHTML.escape(). FAIL Can't find variable: SafeHTML
insertAdjacentHTML = SafeHTML.unsafelyCreate(). FAIL Can't find variable: SafeHTML
/safe-html-types/block-string-assignment-to-location-href.tentative.html
Subtest Results Messages
OK
location.href = string throws FAIL Can't find variable: SafeURL
Basic processing: safe URL, safe construction. FAIL Can't find variable: SafeURL
Basic processing: safe URL, unsafe construction. FAIL Can't find variable: SafeURL
Basic processing: javascript URL, safe construction. FAIL Can't find variable: SafeURL
Basic processing: javascript URL, unsafe construction. FAIL Can't find variable: SafeURL
/safe-html-types/block-string-assignment-to-outerHTML.tentative.html
Subtest Results Messages
OK
outerHTML = string throws. FAIL assert_throws: function "_ => {\n d.outerHTML = "Fail.";\n }" did not throw
outerHTML = SafeHTML.escape(). FAIL Can't find variable: SafeHTML
outerHTML = SafeHTML.unsafelyCreate(). FAIL Can't find variable: SafeHTML
/safe-html-types/document-write.tentative.html
Subtest Results Messages
OK
document.write(SafeHTML). FAIL Can't find variable: SafeHTML
/safe-html-types/innerHTML.tentative.html
Subtest Results Messages
OK
innerHTML = SafeHTML.escape(). FAIL Can't find variable: SafeHTML
innerHTML = SafeHTML.unsafelyCreate(). FAIL Can't find variable: SafeHTML
/safe-html-types/insertAdjacentHTML.tentative.html
Subtest Results Messages
OK
insertAdjacentHTML = SafeHTML.escape(). FAIL Can't find variable: SafeHTML
insertAdjacentHTML = SafeHTML.unsafelyCreate(). FAIL Can't find variable: SafeHTML
/safe-html-types/location-href.tentative.html
Subtest Results Messages
OK
Basic processing: safe URL, safe construction. FAIL Can't find variable: SafeURL
Basic processing: safe URL, unsafe construction. FAIL Can't find variable: SafeURL
Basic processing: javascript URL, safe construction. FAIL Can't find variable: SafeURL
Basic processing: javascript URL, unsafe construction. FAIL Can't find variable: SafeURL
/safe-html-types/outerHTML.tentative.html
Subtest Results Messages
OK
outerHTML = SafeHTML.escape(). FAIL Can't find variable: SafeHTML
outerHTML = SafeHTML.unsafelyCreate(). FAIL Can't find variable: SafeHTML
@w3c-bots
Copy link

w3c-bots commented Jul 4, 2017

View the complete job log.

Chrome (unstable)

Testing web-platform-tests at revision 048d9c4
Using browser at version 61.0.3141.7 dev
Starting 10 test iterations
All results were stable

All results

11 tests ran
/safe-html-types/SafeHTML.tentative.html
Subtest Results Messages
OK
Basic escaping. FAIL SafeHTML is not defined
Basic unsafe construction. FAIL SafeHTML is not defined
/safe-html-types/SafeURL.tentative.html
Subtest Results Messages
OK
Basic processing: safe URL, safe construction. FAIL SafeURL is not defined
Basic processing: safe URL, unsafe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, safe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, unsafe construction. FAIL SafeURL is not defined
Basic processing: external protocol URL, safe construction. FAIL SafeURL is not defined
Basic processing: external protocol URL, unsafe construction. FAIL SafeURL is not defined
/safe-html-types/block-string-assignment-to-innerHTML.tentative.html
Subtest Results Messages
OK
innerHTML = string throws. FAIL assert_throws: function "_ => {\n d.innerHTML = "Fail.";\n }" did not throw
innerHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
innerHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/block-string-assignment-to-insertAdjacentHTML.tentative.html
Subtest Results Messages
OK
insertAdjacentHTML(string) throws. FAIL assert_throws: function "_ => {\n d.insertAdjacentHTML('beforebegin', "<p>Fail</p>");\n }" did not throw
insertAdjacentHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
insertAdjacentHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/block-string-assignment-to-location-href.tentative.html
Subtest Results Messages
OK
location.href = string throws FAIL SafeURL is not defined
Basic processing: safe URL, safe construction. FAIL SafeURL is not defined
Basic processing: safe URL, unsafe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, safe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, unsafe construction. FAIL SafeURL is not defined
/safe-html-types/block-string-assignment-to-outerHTML.tentative.html
Subtest Results Messages
OK
outerHTML = string throws. FAIL assert_throws: function "_ => {\n d.outerHTML = "Fail.";\n }" did not throw
outerHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
outerHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/document-write.tentative.html
Subtest Results Messages
OK
document.write(SafeHTML). FAIL SafeHTML is not defined
/safe-html-types/innerHTML.tentative.html
Subtest Results Messages
OK
innerHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
innerHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/insertAdjacentHTML.tentative.html
Subtest Results Messages
OK
insertAdjacentHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
insertAdjacentHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
/safe-html-types/location-href.tentative.html
Subtest Results Messages
OK
Basic processing: safe URL, safe construction. FAIL SafeURL is not defined
Basic processing: safe URL, unsafe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, safe construction. FAIL SafeURL is not defined
Basic processing: javascript URL, unsafe construction. FAIL SafeURL is not defined
/safe-html-types/outerHTML.tentative.html
Subtest Results Messages
OK
outerHTML = SafeHTML.escape(). FAIL SafeHTML is not defined
outerHTML = SafeHTML.unsafelyCreate(). FAIL SafeHTML is not defined
@w3c-bots
Copy link

w3c-bots commented Jul 4, 2017

View the complete job log.

Sauce (MicrosoftEdge)

Testing web-platform-tests at revision 048d9c4
Using browser at version 14.14393
Starting 10 test iterations
All results were stable

All results

11 tests ran
/safe-html-types/SafeHTML.tentative.html
Subtest Results Messages
OK
Basic escaping. FAIL 'SafeHTML' is undefined
Basic unsafe construction. FAIL 'SafeHTML' is undefined
/safe-html-types/SafeURL.tentative.html
Subtest Results Messages
OK
Basic processing: safe URL, safe construction. FAIL 'SafeURL' is undefined
Basic processing: safe URL, unsafe construction. FAIL 'SafeURL' is undefined
Basic processing: javascript URL, safe construction. FAIL 'SafeURL' is undefined
Basic processing: javascript URL, unsafe construction. FAIL 'SafeURL' is undefined
Basic processing: external protocol URL, safe construction. FAIL 'SafeURL' is undefined
Basic processing: external protocol URL, unsafe construction. FAIL 'SafeURL' is undefined
/safe-html-types/block-string-assignment-to-innerHTML.tentative.html
Subtest Results Messages
OK
innerHTML = string throws. FAIL assert_throws: function "_ => {\n d.innerHTML = "Fail.";\n }" did not throw
innerHTML = SafeHTML.escape(). FAIL 'SafeHTML' is undefined
innerHTML = SafeHTML.unsafelyCreate(). FAIL 'SafeHTML' is undefined
/safe-html-types/block-string-assignment-to-insertAdjacentHTML.tentative.html
Subtest Results Messages
OK
insertAdjacentHTML(string) throws. FAIL assert_throws: function "_ => {\n d.insertAdjacentHTML('beforebegin', "<p>Fail</p>");\n }" did not throw
insertAdjacentHTML = SafeHTML.escape(). FAIL 'SafeHTML' is undefined
insertAdjacentHTML = SafeHTML.unsafelyCreate(). FAIL 'SafeHTML' is undefined
/safe-html-types/block-string-assignment-to-location-href.tentative.html
Subtest Results Messages
OK
location.href = string throws FAIL 'SafeURL' is undefined
Basic processing: safe URL, safe construction. FAIL 'SafeURL' is undefined
Basic processing: safe URL, unsafe construction. FAIL 'SafeURL' is undefined
Basic processing: javascript URL, safe construction. FAIL 'SafeURL' is undefined
Basic processing: javascript URL, unsafe construction. FAIL 'SafeURL' is undefined
/safe-html-types/block-string-assignment-to-outerHTML.tentative.html
Subtest Results Messages
OK
outerHTML = string throws. FAIL assert_throws: function "_ => {\n d.outerHTML = "Fail.";\n }" did not throw
outerHTML = SafeHTML.escape(). FAIL 'SafeHTML' is undefined
outerHTML = SafeHTML.unsafelyCreate(). FAIL 'SafeHTML' is undefined
/safe-html-types/document-write.tentative.html
Subtest Results Messages
OK
document.write(SafeHTML). FAIL 'SafeHTML' is undefined
/safe-html-types/innerHTML.tentative.html
Subtest Results Messages
OK
innerHTML = SafeHTML.escape(). FAIL 'SafeHTML' is undefined
innerHTML = SafeHTML.unsafelyCreate(). FAIL 'SafeHTML' is undefined
/safe-html-types/insertAdjacentHTML.tentative.html
Subtest Results Messages
OK
insertAdjacentHTML = SafeHTML.escape(). FAIL 'SafeHTML' is undefined
insertAdjacentHTML = SafeHTML.unsafelyCreate(). FAIL 'SafeHTML' is undefined
/safe-html-types/location-href.tentative.html
Subtest Results Messages
OK
Basic processing: safe URL, safe construction. FAIL 'SafeURL' is undefined
Basic processing: safe URL, unsafe construction. FAIL 'SafeURL' is undefined
Basic processing: javascript URL, safe construction. FAIL 'SafeURL' is undefined
Basic processing: javascript URL, unsafe construction. FAIL 'SafeURL' is undefined
/safe-html-types/outerHTML.tentative.html
Subtest Results Messages
OK
outerHTML = SafeHTML.escape(). FAIL 'SafeHTML' is undefined
outerHTML = SafeHTML.unsafelyCreate(). FAIL 'SafeHTML' is undefined
@chromium-wpt-export-bot chromium-wpt-export-bot force-pushed the chromium-export-cl-I65e5add5cc7fcbc17f97ca8b737d7a3e1d8cad3b branch from 2b59cde to 16ae10f Compare July 5, 2017 07:02
@mikewest
Copy link
Member

mikewest commented Jul 5, 2017

(This isn't meant for review; it's meant for some discussion that could eventually lead to an explainer for even more discussion. Thanks for ignoring it!)

@chromium-wpt-export-bot chromium-wpt-export-bot force-pushed the chromium-export-cl-I65e5add5cc7fcbc17f97ca8b737d7a3e1d8cad3b branch from 16ae10f to 3a0861d Compare July 5, 2017 08:14
@chromium-wpt-export-bot chromium-wpt-export-bot force-pushed the chromium-export-cl-I65e5add5cc7fcbc17f97ca8b737d7a3e1d8cad3b branch from 3a0861d to b161a19 Compare September 18, 2017 14:11
@w3c-bots
Copy link

w3c-bots commented Sep 18, 2017

Build PASSED

Started: 2017-09-20 11:46:59
Finished: 2017-09-20 11:54:36

View more information about this build on:

@chromium-wpt-export-bot chromium-wpt-export-bot changed the title WIP: Explore adding some "safe" string types. Sep 19, 2017
@chromium-wpt-export-bot chromium-wpt-export-bot force-pushed the chromium-export-cl-I65e5add5cc7fcbc17f97ca8b737d7a3e1d8cad3b branch from b161a19 to 7f5f4d7 Compare September 19, 2017 07:09
@chromium-wpt-export-bot chromium-wpt-export-bot force-pushed the chromium-export-cl-I65e5add5cc7fcbc17f97ca8b737d7a3e1d8cad3b branch 4 times, most recently from 0bc2a97 to 16fee82 Compare September 20, 2017 09:32
After talking with some folks about xtof's [1], I think there's something
there that browsers are uniquely positioned to help out with. This patch
starts sketching out what a set of safe types might look like, and what
it might feel like for a developer to lock themselves out of raw string
assignments to typical XSS sinks like `location.href` or `el.innerHTML`.

This patch implements a first pass at `TrustedHTML` and `TrustedURL`,
along with updates to a few sinks to use these new types. It's by no
means a complete implementation, but should give us enough to play
around with while we experiment with library authors to see how the
layering might work.

Explainer: https://github.com/mikewest/trusted-types
Intent to Implement: https://groups.google.com/a/chromium.org/d/msg/blink-dev/qbOrXp9g3B8/hziymUnHAQAJ

[1]: https://research.google.com/pubs/pub42934.html

P.S. This patch looks huge and ugly, but the majority of the changes are
the renamings of `set{Inner,Outer}HTML` that touch a million tests.

Bug: 739170
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I65e5add5cc7fcbc17f97ca8b737d7a3e1d8cad3b
Reviewed-on: https://chromium-review.googlesource.com/559061
Commit-Queue: Mike West <mkwst@chromium.org>
Reviewed-by: Yoav Weiss <yoav@yoav.ws>
Cr-Commit-Position: refs/heads/master@{#503113}
@chromium-wpt-export-bot chromium-wpt-export-bot force-pushed the chromium-export-cl-I65e5add5cc7fcbc17f97ca8b737d7a3e1d8cad3b branch from 16fee82 to d1d335c Compare September 20, 2017 11:46
@chromium-wpt-export-bot chromium-wpt-export-bot merged commit b08a29b into master Sep 20, 2017
@chromium-wpt-export-bot chromium-wpt-export-bot deleted the chromium-export-cl-I65e5add5cc7fcbc17f97ca8b737d7a3e1d8cad3b branch September 20, 2017 12:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment