Re: [whatwg/dom] Draft integration with Trusted Types, take 2. (PR #1247)

@koto commented on this pull request.



> +  <var>namespace</var>, <a for=Attr>namespace prefix</a> is <var>prefix</var>,
+  <a for=Attr>local name</a> is <var>localName</var> and
+  <a for=Node>node document</a> is <var>element</var>'s <a for=Node>node document</a>.
+
+  <li><p>Set <a>attribute</a>'s <var>value</var> to the result of calling <a>Get Trusted Types-compliant attribute
+ value</a> for <var>attribute</var>, with <var>element</var> and
+ <var>value</var>. [[!TRUSTED-TYPES]]
+
+ <li><p><a for=list>Append</a> <var>attribute</var> to <var>element</var>'s
+ <a for=Element>attribute list</a>.
+
+ <li><p>Set <var>attribute</var>'s <a for=Attr>element</a> to <var>element</var>.
+
+ <li><p><a>Handle attribute changes</a> for <var>attribute</var> with <var>element</var>, null, and
+ <var>attribute</var>'s <a for=Attr>value</a>.
+ <li><p>Return.

Append might be too late, at that point Attr value (a string) is set, so the checks bubbled up to the calling algorithms. Check the current version, I think I missed one callsite in the one you reviewed. Now it should be OK, with the intentional omission of `clone`.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/pull/1247#discussion_r1466222448
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/dom/pull/1247/review/1843460807@github.com>