- From: Frédéric Wang via GitHub <sysbot+gh@w3.org>
- Date: Mon, 06 Jan 2025 12:17:36 +0000
- To: public-svg-issues@w3.org
> Note that in the case of a TrustedScriptURL with a forged stringified, that means setting these properties (e.g. className) would behave differently from properties only accepting a string. @lukewarlow pointed out that this probably not true. Forging the toString() won't make a difference, https://w3c.github.io/trusted-types/dist/spec/#trustedhtml-stringification-behavior will be used and so this will use the extracted data. I guess we should do the same for the ones using SVGAnimatedString -- GitHub Notification of comment by fred-wang Please view or discuss this issue at https://github.com/w3c/svgwg/issues/961#issuecomment-2572996140 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Monday, 6 January 2025 12:17:37 UTC