Improve test coverage of sink values

[lukewarlow]

We should ensure that we have exhaustive coverage of the "sink" value, this is the prefix for violation object samples, aswell as being one of the arguments for the default policy.

[lukewarlow]

Example change web-platform-tests/wpt#45058

[fred-wang]

Trusted Types spec:
https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts

HTML spec:
https://html.spec.whatwg.org/multipage/infrastructure.html#tt-trustedhtml
https://html.spec.whatwg.org/multipage/infrastructure.html#tt-trustedscript
https://html.spec.whatwg.org/multipage/infrastructure.html#tt-trustedscripturl

DOM spec:
whatwg/dom#1268

CSP spec:
https://w3c.github.io/webappsec-csp/#can-compile-strings

SVG spec (merged PR don't seem to show up on https://svgwg.org/svg2-draft):
w3c/svgwg#934

Service Workers spec:
https://w3c.github.io/ServiceWorker/#ref-for-dom-serviceworkercontainer-register

execCommand draft:
https://w3c.github.io/editing/docs/execCommand/#methods-to-query-and-execute-commands

Blink IDL: https://source.chromium.org/search?q=(TrustedHTML%20OR%20TrustedScript%20OR%20TrustedScriptURL%20OR%20TrustedType)%20AND%20filepath:third_party%2Fblink%2Frenderer%2Fcore%20AND%20file:idl&start=1

WebKit IDL: https://searchfox.org/wubkat/search?q=TrustedHTML%7CTrustedScriptURL%7CTrustedScript%7CTrustedType&path=.idl%24&case=false&regexp=true

Gecko IDL: https://searchfox.org/mozilla-central/search?q=TrustedHTML%7CTrustedScriptURL%7CTrustedScript%7CTrustedType&path=.webidl%24&case=false&regexp=true

Note that checking the IDL does not give the complete list of sinks, for example eval and function constructors ends up using https://w3c.github.io/webappsec-csp/#can-compile-strings

[fred-wang]

Trusted Types spec:

• HTMLScriptElement's innerText (TrustedScript) -- covered by block-string-assignment-to-text-and-url-sinks.html
• HTMLScriptElement's textContent (TrustedScript) -- covered by block-string-assignment-to-text-and-url-sinks.html
• HTMLScriptElement's src (TrustedScriptURL) -- covered block-string-assignment-to-text-and-url-sinks.html
• HTMLScriptElement's text (TrustedScript) -- block-string-assignment-to-text-and-url-sinks.html

HTML spec:

• Document's write() (TrustedHTML) -- covered by block-string-assignment-to-Document-write.html
• Document's writeln() (TrustedHTML) -- covered by block-string-assignment-to-Document-write.html
• Document's parseHTMLUnsafe() (TrustedHTML) -- covered by block-string-assignment-to-Document-parseHTMLUnsafe.html
• HTMLIFrameElement's srcdoc (TrustedHTML) -- covered by block-string-assignment-to-HTMLIFrameElement-srcdoc.html
• Element's setHTMLUnsafe()̀ (TrustedHTML`) -- covered by block-string-assignment-to-Element-setHTMLUnsafe.html
• Element's innerHTML (TrustedHTML) -- block-string-assignment-to-text-and-url-sinks.html
• Element's outerHTML (TrustedHTML) -- covered by block-string-assignment-to-Element-outerHTML.html
• Element's insertAdjacentHTML() (TrustedHTML) -- covered by block-string-assignment-to-Element-insertAdjacentHTML.html
• ShadowRoot's setHTMLUnsafe() (TrustedHTML) -- covered by block-string-assignment-to-ShadowRoot-setHTMLUnsafe.html
• ShadowRoot's innerHTML (TrustedHTML) -- covered by block-string-assignment-to-ShadowRoot-innerHTML.html
• DOMParser's parseFromString()̀ (TrustedHTML`) -- covered by block-string-assignment-to-DOMParser-parseFromString.html
• Range's createContextualFragment() (TrustedHTML) -- covered by block-string-assignment-to-Range-createContextualFragment.html
• eval() (TrustedScript) -- covered by block-eval-function-constructor.html
• WindowOrWorkerGlobalScope's setTimeout() (TrustedScript) -- covered by block-string-assignment-to-DOMWindowTimers-setTimeout-setInterval.html (done in block-string-assignment-to-DOMWindowTimers-setTimeout-setInterval.js, which is loaded from Window, Worker and SharedWorker)
• WindowOrWorkerGlobalScope's setInterval() (TrustedScript) -- covered by block-string-assignment-to-DOMWindowTimers-setTimeout-setInterval.html (done in block-string-assignment-to-DOMWindowTimers-setTimeout-setInterval.js, which is loaded from Window, Worker and SharedWorker)
• WorkerGlobalScope's importScripts() (TrustedScriptURL) -- covered by trusted-types/support/WorkerGlobalScope-importScripts.https.js
• Worker's constructor (TrustedScriptURL) -- covered by worker-constructor.https.html (from Window) and WorkerGlobalScope-worker-constructor.html (from DedicatedWorker/SharedWorker)
• SharedWorker's constructor (TrustedScriptURL) -- covered by worker-constructor.https.html

DOM spec:

• Element's setAttribute() (TrustedType) -- covered by set-event-handlers-content-attributes.tentative.html (event handler attributes) and Element-setAttribute-setAttributeNS-sinks.tentative.html (other attributes)
• Element's setAttributeNS() (TrustedType) -- covered by set-event-handlers-content-attributes.tentative.html (event handler attributes) and Element-setAttribute-setAttributeNS-sinks.tentative.html (other attributes)

CSP spec:

• eval() (TrustedScript) -- covered by block-eval-function-constructor.html
• function constructor (TrustedScript) -- covered by block-eval-function-constructor.html

SVG spec:

• SVGAnimatedString's baseVal (TrustedScriptURL) -- this seems essentially used for SVGScriptElement's href, but the spec status is a bit fuzzy. -- covered by trusted-types-svg-script-set-href.html
• Luke mentioned SVGScriptElement should have similar script enforcement as HTML. For now we have block-string-assignment-to-text-and-url-sinks.html and a few other tests, but they will need to be checked again when we amend the SVG spec.

Service Workers spec:

• ServiceWorkerContainer's register() (TrustedScriptURL) -- covered by worker-constructor.https.html (from Window) and ServiceWorkerContainer-register-from-Worker.https.html (from Worker)

execCommand draft:

• Document's execCommand() (TrustedHTML) -- covered by block-Document-execCommand.html

[lukewarlow]

There's also SVGScriptElement which needs handling it's just not specced yet

[fred-wang]

@lukewarlow yes I noticed that. It seems some PRs have been merged but are still not public. will follow-up with you privately

[fred-wang]

#494 (comment) should now be an up-to-date list of existing sinks. Still need to check whether we cover everything. The state of the SVG spec is still not great, but essentially we would make SVGScriptElement behave similarly to HTMLScriptElement.

Everything that is implemented in Gecko or WebKit is covered by one of the spec at #494 (comment) but Chromium still seems to implement legacy stuff (probably we should write some tests to verify these are not valid sinks):

https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/dom/child_node_part.idl?q=(TrustedHTML%20OR%20TrustedScript%20OR%20TrustedScriptURL%20OR%20TrustedType)%20AND%20filepath:third_party%2Fblink%2Frenderer%2Fcore%20AND%20file:idl&start=11
https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/dom/parent_node.idl?q=(TrustedHTML%20OR%20TrustedScript%20OR%20TrustedScriptURL%20OR%20TrustedType)%20AND%20filepath:third_party%2Fblink%2Frenderer%2Fcore%20AND%20file:idl&start=11
https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/dom/child_node.idl?q=(TrustedHTML%20OR%20TrustedScript%20OR%20TrustedScriptURL%20OR%20TrustedType)%20AND%20filepath:third_party%2Fblink%2Frenderer%2Fcore%20AND%20file:idl&start=11

[fred-wang]

Everything that is implemented in Gecko or WebKit is covered by one of the spec at #494 (comment) but Chromium still seems to implement legacy stuff (probably we should write some tests to verify these are not valid sinks).

Tests added in web-platform-tests/wpt#49920 for ParentNode/ChildNode and support remove from Chromium for DOM parts in https://chromium-review.googlesource.com/c/chromium/src/+/6150068.

[fred-wang]

I'm closing this issue as complete. Potential improvements that can be done separately:

• Refine tests about content handler attributes for example Add test for event handler content attribute handling for false positive event handler attributes #573
• Refine tests for SVG attributes, once the specs have more details on script enforcement.
• Do similar tests for violation object samples.

[fred-wang]

Do similar tests for violation object samples.

This can be tracked in #576