Bug 1940068 [wpt PR 49920] - Add test to verify legacy sinks for Trus…

…tedScript are not supported, a=testonly Automatic update from web-platform-tests Add test to verify legacy sinks for TrustedScript are not supported (#49920) This verifies some API for ParentNode/ChildNode [1] [2] don't do any check for trusted types. This might already be covered by IDL tests but we just perform a direct verification here. This test fails in Chromium, which is not aligned with the DOM spec here [3] and performs specific checks for HTML script elements. Chromium also implements similar behavior for `ChildNodePart.replaceChildren()` but that's currently not shipped [4]. [1] https://dom.spec.whatwg.org/#interface-parentnode [2] https://dom.spec.whatwg.org/#interface-childnode [3] w3c/trusted-types#494 (comment) [4] https://groups.google.com/a/chromium.org/g/blink-dev/c/wIADRnljZDA/m/whzEaaAADAAJ -- wpt-commits: dc4c46629bdddcb8a4cd1f3dc702cb4d2f5eb4ee wpt-pr: 49920 UltraBlame original commit: b9478748139d73216a1c81ea40747000934f52bc
marco-c · Jan 16, 2025 · 4ec63ba · 4ec63ba
1 parent 3904a8e
commit 4ec63ba
Showing 1 changed file with 32 additions and 0 deletions.
diff --git a/testing/web-platform/tests/trusted-types/legacy-trusted-scripts.html b/testing/web-platform/tests/trusted-types/legacy-trusted-scripts.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">
+<div id="log"></div>
+<script id="prependScript">;</script>
+<script id="appendScript">;</script>
+<script id="replaceChildrenScript">;</script>
+<script id="beforeScript">;</script>
+<script id="afterScript">;</script>
+<script id="replaceWithScript">;</script>
+<script>
+test(t => {
+  prependScript.prepend("1", "2", "3");
+  assert_equals(prependScript.textContent, "123;");
+
+  appendScript.append("1", "2", "3");
+  assert_equals(appendScript.textContent, ";123");
+
+  replaceChildrenScript.replaceChildren("1", "2", "3");
+  assert_equals(replaceChildrenScript.textContent, "123");
+
+  beforeScript.firstChild.before("1", "2", "3");
+  assert_equals(beforeScript.textContent, "123;");
+
+  afterScript.firstChild.after("1", "2", "3");
+  assert_equals(afterScript.textContent, ";123");
+
+  replaceWithScript.firstChild.replaceWith("1", "2", "3");
+  assert_equals(replaceWithScript.textContent, "123");
+}, "Legacy sinks for TrustedScript accept arbitrary strings.");
+</script>