diff --git a/spec/index.bs b/spec/index.bs index e023b1be..535cdf28 100644 --- a/spec/index.bs +++ b/spec/index.bs @@ -1248,23 +1248,15 @@ partial interface mixin WindowOrWorkerGlobalScope { }; -To the [[HTML5#timer-initialisation-steps|timer initialization steps algorithm]], -add this step between 7.1 and 7.2: - -1. If the first operation argument is not a {{Function}}, set the first operation argument to the result of executing - the [$Get Trusted Type compliant string$] algorithm, with - * |global| set to the [=this=] value's [=relevant global object=]. - * |input| set to the first method argument, and - * |expectedType| set to {{TrustedScript}}. - * |sink| set to `Window setInterval` if repeat is true, `Window setTimeout` otherwise. - * |sinkGroup| set to `'script'`. - - Note: This matches the logic that the extended attribute would apply. - Note: This makes sure that a {{TrustedScript}} is passed to timer functions in place of a string when Trusted Types are enforced, but also unconditionally accepts any {{Function}} object. +To the [[HTML5#timer-initialisation-steps|timer initialization steps algorithm]], +change step 8.4.3 as follows: + +1. Perform HostEnsureCanCompileStringsEnsureCSPDoesNotBlockStringCompilation(realm, « », handler, false, handler, ~timer~, « », handler). If this throws an exception, catch it, report the exception, and abort these steps. + ### Enforcement in event handler content attributes ### {#enforcement-in-event-handler-content-attributes} This document modifies the @@ -1668,32 +1660,35 @@ The Trusted Types portion of this algorithm uses |calleeRealm| and its CSP setti Given a [[ECMA-262#realm|realm]] (|calleeRealm|), a list of strings (|parameterStrings|), a string (|bodyString|), a string (|source|), an enum (|compilationType|), a list of ECMAScript language values (|parameterArgs|), and an ECMAScript language value (|bodyArg|), this algorithm returns normally if compilation is allowed, and throws an "`EvalError`" if not: -1. Let |compilationSink| be `"Function"` if |compilationType| is `*FUNCTION*`, otherwise `"Eval"`. -1. Let |isTrusted| be `true`. -1. If |bodyArg| is not a {{TrustedScript}} object, set |isTrusted| to `false`. -1. If |isTrusted| is `true` then: - 1. If |bodyString| is not equal to |bodyArg|'s [=TrustedScript/[[Data]]=] internal slot, set |isTrusted| to `false`. -1. If |isTrusted| is `true`, then: - 1. For each |arg| in |parameterArgs|: - 1. Let |index| be the index of |arg| in |parameterArgs|. - 1. If |arg| is not a {{TrustedScript}} object, set |isTrusted| to `false`. - 1. If |isTrusted| is `true`, then: - 1. if |parameterStrings|[|index|] is not equal to |arg|'s [=TrustedScript/[[Data]]=] internal slot, set |isTrusted| to `false`. -1. If |isTrusted| is `true`, let |sourceToValidate| be a new instance of - the {{TrustedScript}} interface, with its [=TrustedScript/[[Data]]=] internal slot value - set to |source|. Otherwise, let |sourceToValidate| be |source|. - -1. Let |sourceString| be the result of executing the - [$Get Trusted Type compliant string$] algorithm, with: - * |calleeRealm| as |global|, - * |sourceToValidate| as |input|, - * |compilationSink| as |sink|, - * `'script'` as |sinkGroup|, - * {{TrustedScript}} as |expectedType|. - -1. If the algorithm throws an error, throw an {{EvalError}}. - -1. If |sourceString| is not equal to |source|, throw an {{EvalError}}. +1. If |compilationType| is `*TIMER*`, then: + 1. Let |sourceString| be |source|. +1. Else: + 1. Let |compilationSink| be `"Function"` if |compilationType| is `*FUNCTION*`, otherwise `"Eval"`. + 1. Let |isTrusted| be `true`. + 1. If |bodyArg| is not a {{TrustedScript}} object, set |isTrusted| to `false`. + 1. If |isTrusted| is `true` then: + 1. If |bodyString| is not equal to |bodyArg|'s [=TrustedScript/[[Data]]=] internal slot, set |isTrusted| to `false`. + 1. If |isTrusted| is `true`, then: + 1. For each |arg| in |parameterArgs|: + 1. Let |index| be the index of |arg| in |parameterArgs|. + 1. If |arg| is not a {{TrustedScript}} object, set |isTrusted| to `false`. + 1. If |isTrusted| is `true`, then: + 1. if |parameterStrings|[|index|] is not equal to |arg|'s [=TrustedScript/[[Data]]=] internal slot, set |isTrusted| to `false`. + 1. If |isTrusted| is `true`, let |sourceToValidate| be a new instance of + the {{TrustedScript}} interface, with its [=TrustedScript/[[Data]]=] internal slot value + set to |source|. Otherwise, let |sourceToValidate| be |source|. + + 1. Let |sourceString| be the result of executing the + [$Get Trusted Type compliant string$] algorithm, with: + * |calleeRealm| as |global|, + * |sourceToValidate| as |input|, + * |compilationSink| as |sink|, + * `'script'` as |sinkGroup|, + * {{TrustedScript}} as |expectedType|. + + 1. If the algorithm throws an error, throw an {{EvalError}}. + + 1. If |sourceString| is not equal to |source|, throw an {{EvalError}}. 1. Let |global| be a |calleeRealm|'s [=realm/global object=].