| 07:45 | <Noam Rosenthal> | @smaug:mozilla.org @zcorpan:mozilla.org: good morning! any thoughts about https://github.com/whatwg/html/issues/12652? Seems like blink/webkit are ok with simplifying things in that bit around "allow declarative shadow roots" |
| 07:51 | <smaug> | Changing document.open feels a bit risky |
| 07:54 | <smaug> | Some telemetry data there could reveal something? |
| 07:55 | <Noam Rosenthal> | wdym? this is not a security thing, more of a backwards compat thing? |
| 07:57 | <smaug> | I wasn't thinking security but webcompat |
| 07:57 | <Noam Rosenthal> | ah gotcha |
| 07:58 | <Noam Rosenthal> | note that currently document.open has allowDeclarativeShadowRoots on for the main doc |
| 07:58 | <smaug> | sure |
| 07:59 | <Noam Rosenthal> | this only changes document.open on documents created with XHR and the such. I don't think it's very common |
| 07:59 | <smaug> | "allow declarative shadow roots" is super weird, that I admit |
| 08:00 | <smaug> | parseHTML sets it always true? |
| 08:01 | <smaug> | I assume we can get rid of it, but a tiny bit of telemetry data would give some confidence |
| 08:02 | <smaug> | (I can see use cases for using document.open/write with data documents and this would change that behavior) |
| 08:19 | <Noam Rosenthal> | parseHTML sets it always true? |
| 08:21 | <Noam Rosenthal> | I assume we can get rid of it, but a tiny bit of telemetry data would give some confidence |
| 08:22 | <Noam Rosenthal> | But I am happy to collect that first if it adds confidence |
| 08:54 | <zcorpan> | It sounds like a super-rare case |
| 08:56 | <Noam Rosenthal> | note that it's also for detached document streaming which might be less rare ( document.implementation.createHTMLDocument().write(html)) |
| 08:57 | <Noam Rosenthal> | and I'm kind of OK with making dsd work there... it's not like we're breaking something. Sure keeping innerHTML behavior without it makes sense |
| 09:02 | <zcorpan> | What was the security rationale for innerHTML? That it could introduce a way to bypass sanitizers? |
| 09:04 | <Noam Rosenthal> | I guess it made <template> something that's potentially unsafe |
| 09:09 | <Noam Rosenthal> | Yea it's an mXSS discussion from 2020, see https://github.com/whatwg/dom/issues/831#issuecomment-714240292 I think it was never an issue TBH... downstream sanitizers normally use attribute allowlists, blocklist ones are discouraged for this kind of reason |
| 09:10 | <Noam Rosenthal> | Downstream sanitizers don't really work that well with document.write() anyway because they don't stream |
| 09:11 | <Noam Rosenthal> | Also not sure if checking DSD rejection with telemetry will tell us the story; if we allow DSD to an existing detached document streaming code path it might not be exploited yet... we'll have to check if people use detached document streaming at all and we know people use that. |
| 09:22 | <zcorpan> | Noam Rosenthal: sanitizers removing the attribute on But if sanitizers don't use |
| 09:25 | <Noam Rosenthal> | Server side sanitizers allowing <template> and not checking its attributes would be a problem. But that's not a thing... even very old sanitizers are "deny-by-default", otherwise a lot of the web platform would be in trouble |
| 09:25 | <Noam Rosenthal> | TBC - server-side sanitizers usually require the whole document's AST and don't know how to sanitize a partial string like what you'd put into document.write() |
| 09:26 | <zcorpan> | Noam Rosenthal: I mean a client-side sanitizer that itself uses document.write in its sanitization code path |
| 09:27 | <Noam Rosenthal> | oh yea that's definitely not a thing |
| 09:31 | <zcorpan> | So... maybe shipping on canary and 50% of beta or similar would provide an answer to if it's web compatible? |
| 09:32 | <Noam Rosenthal> | Yea I like that better than ahead-of-time telemetry. |
| 09:32 | <Noam Rosenthal> | but actually I don't think it would teach us much, because if this is an mXSS prevention, we'd be adding the mXSS vector and shipping it wouldn't tell us if it's exploited |
| 09:34 | <Noam Rosenthal> | all it would do is make detached document streaming respect <template shadowrootmode>. I don't think anyone would complain about it until it's exploited for mXSS. (but for it to be exploited for mXSS you'd need very badly configured sanitizers in the first place in conjunction with detached document streaming etc) |
| 09:50 | <zcorpan> | Noam Rosenthal: I thought the argument for some testing or data collection was currently-unknown usage that would break. But I think it's unlikely. smaug wdyt |
| 09:52 | <Noam Rosenthal> | yea "breaking" here is making DSD work so I don't think anyone would complain about that |
| 09:52 | <Noam Rosenthal> | (I thought it was about this as well but it's actually an mXSS thing) |