LibWeb: Implement Trusted Types for HTMLIFrameElement#srcdoc

Author: https://github.com/Lubrsi
Commit: d211df8118
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/6632
Reviewed-by: https://github.com/AtkinsSJ

Libraries/LibWeb/HTML/HTMLIFrameElement.cpp

@@ -19,6 +19,8 @@
 #include <LibWeb/HTML/Parser/HTMLParser.h>
 #include <LibWeb/HTML/TraversableNavigable.h>
 #include <LibWeb/Layout/NavigableContainerViewport.h>
+#include <LibWeb/TrustedTypes/TrustedTypePolicy.h>
+#include <LibWeb/TrustedTypes/RequireTrustedTypesForDirective.h>
 
 namespace Web::HTML {
 
@@ -305,4 +307,31 @@ void HTMLIFrameElement::set_current_navigation_was_lazy_loaded(bool value)
     set_potentially_delays_the_load_event(!value);
 }
 
+// https://html.spec.whatwg.org/multipage/iframe-embed-object.html#dom-iframe-srcdoc
+TrustedTypes::TrustedHTMLOrString HTMLIFrameElement::srcdoc()
+{
+    // 1. Let attribute be the result of running get an attribute by namespace and local name given null, srcdoc's
+    //    local name, and this.
+    // 2. If attribute is null, then return the empty string.
+    // 3. Return attribute's value.
+    return Utf16String::from_utf8(get_attribute_value(AttributeNames::srcdoc));
+}
+
+// https://html.spec.whatwg.org/multipage/iframe-embed-object.html#dom-iframe-srcdoc
+WebIDL::ExceptionOr<void> HTMLIFrameElement::set_srcdoc(TrustedTypes::TrustedHTMLOrString const& value)
+{
+    // 1. Let compliantString be the result of invoking the Get Trusted Type compliant string algorithm with
+    //      TrustedHTML, this's relevant global object, the given value, "HTMLIFrameElement srcdoc", and "script".
+    auto const compliant_string = TRY(TrustedTypes::get_trusted_type_compliant_string(
+        TrustedTypes::TrustedTypeName::TrustedHTML,
+        HTML::relevant_global_object(*this),
+        value,
+        TrustedTypes::InjectionSink::HTMLIFrameElementsrcdoc,
+        TrustedTypes::Script.to_string()));
+
+    // 2. Set an attribute value given this, srcdoc's local name, and compliantString.
+    set_attribute_value(AttributeNames::srcdoc, compliant_string.to_utf8_but_should_be_ported_to_utf16());
+    return {};
+}
+
 }

Libraries/LibWeb/HTML/HTMLIFrameElement.h

@@ -38,6 +38,9 @@ public:
 
     SandboxingFlagSet iframe_sandboxing_flag_set() const { return m_iframe_sandboxing_flag_set; }
 
+    TrustedTypes::TrustedHTMLOrString srcdoc();
+    WebIDL::ExceptionOr<void> set_srcdoc(TrustedTypes::TrustedHTMLOrString const& value);
+
     virtual void visit_edges(Cell::Visitor&) override;
 
 private:

Libraries/LibWeb/HTML/HTMLIFrameElement.idl

@@ -1,6 +1,7 @@
 #import <HTML/HTMLElement.idl>
 #import <HTML/Scripting/Fetching.idl>
 #import <DOM/Document.idl>
+#import <TrustedTypes/TrustedHTML.idl>
 
 // https://html.spec.whatwg.org/multipage/iframe-embed-object.html#htmliframeelement
 [Exposed=Window]
@@ -9,7 +10,7 @@ interface HTMLIFrameElement : HTMLElement {
     [HTMLConstructor] constructor();
 
     [CEReactions, Reflect, URL] attribute USVString src;
-    [CEReactions, Reflect] attribute DOMString srcdoc;
+    [CEReactions] attribute (TrustedHTML or Utf16DOMString) srcdoc;
     [CEReactions, Reflect] attribute DOMString name;
     [SameObject, PutForwards=value] readonly attribute DOMTokenList sandbox;
     [CEReactions, Reflect] attribute DOMString allow;

Tests/LibWeb/Text/expected/wpt-import/trusted-types/HTMLElement-generic.txt

@@ -2,8 +2,7 @@ Harness status: OK
 
 Found 72 tests
 
-68 Pass
-4 Fail
+72 Pass
 Pass	TT disabled: script.src
             = TrustedScript on a
             connected element
@@ -132,11 +131,11 @@ Pass	TT enabled: div.innerHTML
             = String on a
             non-connected element
             
-Fail	TT enabled: iframe.srcdoc
+Pass	TT enabled: iframe.srcdoc
             = TrustedHTML on a
             connected element
             
-Fail	TT enabled: iframe.srcdoc
+Pass	TT enabled: iframe.srcdoc
             = TrustedHTML on a
             non-connected element
             
@@ -228,11 +227,11 @@ Pass	TT enabled: div.innerHTML
             = String on a
             non-connected element
             after removing the "require-trusted-types-for 'script' directive
-Fail	TT enabled: iframe.srcdoc
+Pass	TT enabled: iframe.srcdoc
             = TrustedHTML on a
             connected element
             after removing the "require-trusted-types-for 'script' directive
-Fail	TT enabled: iframe.srcdoc
+Pass	TT enabled: iframe.srcdoc
             = TrustedHTML on a
             non-connected element
             after removing the "require-trusted-types-for 'script' directive

Tests/LibWeb/Text/expected/wpt-import/trusted-types/block-string-assignment-to-HTMLElement-generic.txt

@@ -2,11 +2,11 @@ Harness status: OK
 
 Found 9 tests
 
-7 Pass
-2 Fail
+8 Pass
+1 Fail
 Pass	script.src accepts only TrustedScriptURL
 Pass	div.innerHTML accepts only TrustedHTML
-Fail	iframe.srcdoc accepts only TrustedHTML
+Pass	iframe.srcdoc accepts only TrustedHTML
 Pass	script.src accepts string and null after default policy was created
 Fail	div.innerHTML accepts string and null after default policy was created
 Pass	iframe.srcdoc accepts string and null after default policy was created

Tests/LibWeb/Text/expected/wpt-import/trusted-types/block-string-assignment-to-HTMLIFrameElement-srcdoc.txt

@@ -2,9 +2,8 @@ Harness status: OK
 
 Found 5 tests
 
-4 Pass
-1 Fail
-Fail	iframe.srcdoc assigned via policy (successful HTML transformation).
+5 Pass
+Pass	iframe.srcdoc assigned via policy (successful HTML transformation).
 Pass	`iframe.srcdoc = string` throws.
 Pass	`iframe.srcdoc = null` throws.
 Pass	`iframe.srcdoc = string` assigned via default policy (successful HTML transformation).

Tests/LibWeb/Text/expected/wpt-import/trusted-types/policy-without-return-value.sub.txt

@@ -2,9 +2,9 @@ Harness status: OK
 
 Found 4 tests
 
-2 Pass
-2 Fail
+3 Pass
+1 Fail
 Fail	createHTML with a policy that returns undefined DOMParser
-Fail	createHTML with a policy that returns undefined iframe.srcdoc
+Pass	createHTML with a policy that returns undefined iframe.srcdoc
 Pass	createScript with a policy that returns undefined <div onload>
 Pass	createScriptURL with a policy that returns undefined script.src

Tests/LibWeb/Text/expected/wpt-import/trusted-types/require-trusted-types-for-TypeError-belongs-to-the-global-object-realm.txt

@@ -2,7 +2,6 @@ Harness status: OK
 
 Found 2 tests
 
-1 Pass
-1 Fail
+2 Pass
 Pass	Setting innerHTML on a node inserted by the parser.
-Fail	Setting innerHTML on a node adopted from a subframe.
+Pass	Setting innerHTML on a node adopted from a subframe.