| 10:43 | <annevk> | I'm still reviewing the TT change. AI says some of the domintro and notes might be stale.
- source:126274, 126518, 126611, 126737 — the four domintro TypeError sentences are now wrong and should be deleted. They say: "Throws a TypeError if the node document is an XML document and a Trusted Types default policy supplied a sanitizer
(unless Content Security Policy is report-only)." With the fall-through, an XML document skips createParserOptions entirely, so the XML path is now identical to pre-PR behavior. Concretely, XHTML document + require-trusted-types-for 'script' enforced + default policy {createHTML: s => s, createParserOptions: o => ({...o, sanitizer})}: documentType is "xml" → shortcut skipped → get trusted type compliant string → createHTML runs → no TypeError, contradicting the sentence. And in the case where it does throw (no createHTML), the cause is the ordinary sink-type mismatch, not the supplied sanitizer — that throw already happens on main today. This PR introduces no new exception in XML documents, so all four sentences describe behavior that doesn't exist.
|
| 10:46 | <annevk> | Here's the rest https://gist.github.com/annevk/adeb57f8be2ccd3d75fb8d8523cf598a#file-tt-4-txt |
| 10:48 | <annevk> | This behavior for XML does make sense I think. Especially if we also make TrustedHTML throw. |
| 11:21 | <Noam Rosenthal> | OK fixed those issues (they're mostly changes to domintro and PR description to reflect the most recent changes). Also added a WPT for cloning the sanitizer config (https://github.com/web-platform-tests/wpt/pull/62484) |