Skip to content

Commit

Permalink
[readme] update champions
Browse files Browse the repository at this point in the history
also comment out polyfill section, since that is inappropriate prior to stage 3
  • Loading branch information
ljharb committed May 30, 2024
1 parent 0001239 commit b5ce803
Showing 1 changed file with 17 additions and 31 deletions.
48 changes: 17 additions & 31 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,10 @@
# Array.isTemplateObject explainer (stage [2](https://tc39.es/process-document/))

Authors: [@mikesamuel](https://github.com/mikesamuel), [@koto](https://github.com/koto)
Champion: [@koto](https://github.com/koto)
Champions: [@littledan](https://github.com/littledan), [@ljharb](https://github.com/ljharb)
Reviewers: [@erights](https://github.com/erights), [@jridgewell](https://github.com/jridgewell)

Provides a way for template tag functions to tell whether they were
called with a template string bundle.
Provides a way for template tag functions to tell whether they were called with a template string bundle.

**Table of Contents**

Expand All @@ -23,18 +22,15 @@ called with a template string bundle.

### Distinguishing strings from a trusted developer from strings that may be attacker controlled

Issue [WICG/trusted-types#96](https://github.com/WICG/trusted-types/issues/96)
describes a scenario where a template tag assumes that the literal strings were
authored by a trusted developer but that the interpolated values may not be.
Issue [WICG/trusted-types#96](https://github.com/WICG/trusted-types/issues/96) describes a scenario where a template tag assumes that the literal strings were authored by a trusted developer but that the interpolated values may not be.

```js
result = sensitiveOperation`trusted0 ${ untrusted } trusted1`
// Authored by dev ^^^^^^^^ ^^^^^^^^
// May come from outside ^^^^^^^^^
```

This proposal would provide enough context to warn or error out when this
is not the case.
This proposal would provide enough context to warn or error out when this is not the case.

```js
function (trustedStrings, ...untrustedArguments) {
Expand All @@ -60,17 +56,13 @@ let x = eval(attackerControlledString)
console.log(Array.isTemplateObject(x));
```

Many other security assumptions break if an attacker can execute arbitrary code,
so this check is still useful.
Many other security assumptions break if an attacker can execute arbitrary code, so this check is still useful.

## An Example

Here's an example of how `isTemplateObject` lets a tag function wisely
use a sensitive operation, namely *[Create a Trusted Type][]*. The
sensitive operation is not directly accessible to the tag function's
callers since it's in a local scope. This assumes that TT's [first-come-first-serve name restrictions][TT-block] solve
provisioning, letting only authorized callers access the sensitive
operation.
Here's an example of how `isTemplateObject` lets a tag function wisely use a sensitive operation, namely *[Create a Trusted Type][]*.
The sensitive operation is not directly accessible to the tag function's callers since it's in a local scope.
This assumes that TT's [first-come-first-serve name restrictions][TT-block] solve provisioning, letting only authorized callers access the sensitive operation.

```js
const { Array, TypeError } = globalThis;
Expand Down Expand Up @@ -147,37 +139,32 @@ console.log(`f(${ JSON.stringify(payload) }) = ${ f(payload) }`);
```

The threat model here involves three actors:
* A team of *first-party developers* (in conjunction with security
specialists) decides to trust the tag function.
* A team of *first-party developers* (in conjunction with security specialists) decides to trust the tag function.
* A malicious *attacker* controls a string in the variable `payload`.
* Non-malicious but confusable third-party library tries to provide a
higher level of service by forging a template object.
It assumes its clients are comfortable with trusting
`dodgyMarkdownToHTMLConverter` to produce HTML for the current origin.
* Non-malicious but confusable third-party library tries to provide a higher level of service by forging a template object.
It assumes its clients are comfortable with trusting `dodgyMarkdownToHTMLConverter` to produce HTML for the current origin.

We've addressed this threat model when the first-party developers can
be less tolerant of risk than the most risk tolerant third party
dependency w.r.t. HTML injection.
We've addressed this threat model when the first-party developers can be less tolerant of risk than the most risk tolerant third party dependency w.r.t. HTML injection.

This simple implementation doesn't deal with interpolations.
A more thorough implementation could do [contextual autoescaping][].

## What this is not

This is not an attempt to determine whether the current function was called as a template literal.
See the linked issue as to why that is untenable. Especially the discussion around threat models,
`eval` and tail-call optimizations that weighed against alternate approaches.
See the linked issue as to why that is untenable. Especially the discussion around threat models, `eval`, and tail-call optimizations that weighed against alternate approaches.

## Possible Spec Language

You can browse the [ecmarkup output](https://tc39.es/proposal-array-is-template-object/)
or browse the [source](https://github.com/tc39/proposal-array-is-template-object/blob/master/spec.emu).
You can browse the [ecmarkup output](https://tc39.es/proposal-array-is-template-object/) or browse the [source](https://github.com/tc39/proposal-array-is-template-object/blob/master/spec.emu).

<!--
## Polyfill
An es-shim API compatible polyfill available at [![npm](https://img.shields.io/npm/v/is-template-object.svg)](https://www.npmjs.com/package/is-template-object).
A polyfill is available in the [core-js](https://github.com/zloirock/core-js) library. You can find it in the [ECMAScript proposals section](https://github.com/zloirock/core-js#arrayistemplateobject).
-->

## Tests

Expand All @@ -188,8 +175,7 @@ which would be added under

## Related Work

If the [literals proposal](https://github.com/mikewest/tc39-proposal-literals) were to advance,
this proposal would be unnecessary since they both cover the use cases from this document.
If the [literals proposal](https://github.com/mikewest/tc39-proposal-literals) were to advance, this proposal would be unnecessary since they both cover the use cases from this document.

[contextual autoescaping]: https://rawgit.com/mikesamuel/sanitized-jquery-templates/trunk/safetemplate.html
[TT-block]: https://w3c.github.io/webappsec-trusted-types/dist/spec/#abstract-opdef-should-trusted-type-policy-creation-be-blocked-by-content-security-policy
Expand Down

0 comments on commit b5ce803

Please sign in to comment.