3 ms·

From a cursory glance, the replacement (Trusted Types), just seems like a very cumbersome runtime type-safety engine kind of thing, shoehorned into a JS/DOM con

From a cursory glance, the replacement (Trusted Types), just seems like a very cumbersome runtime type-safety engine kind of thing, shoehorned into a JS/DOM context. Is that a correct understanding? If so... Why use this cumbersome API instead of just relying on existing and well-implemented concepts as already present in Flow or Typescript? That way you could have Flow or Typescript also compile to whatever form this required to have. Or am I missing some key bits here?

m12k 7y ago
This isn't a programming language type safety mechanism, it's a way to tell the browser to enforce that you can't run code that could potentially be vulnerable to XSS, except in specific places that you designate with policies. This example was illuminating for me: https://developers.google.com/web/updates/2019/02/trusted-types#trusted-types https://developers.google.com/web/updates/2019/02/trusted-ty...
- josteink 7y ago
  Tomato/tomato. You are effectively saying that only certain types of strings and DOM structures are allowed on certain properties and attributes. This is perfectly encodable in a type-system. I don’t see a reason to dismiss that observation outright.
aflag 7y ago
As far as I know typescripts add types to JavaScript which will enforce tests for certain classes of programming errors. Trusted types is a custom validator for what is allowed to be assigned to innerHTML and the like. That check is done during runtime. Typescript doesn't prevent untrusted code from being infected, but hopefully your validator will.
- koto1sa 7y ago
  Exactly. That said, because the API itself is typed, it is possible to have the runtime enforcement also verified when statically type-checking your application code (e.g. that innerHTML is passed a TrustedHTML value, and not a string) in Flow, TypeScript or type-aware linters - like this: https://youtu.be/1KQngEZ8qH4?t=1330 https://youtu.be/1KQngEZ8qH4?t=1330

m12k 7y ago

This isn't a programming language type safety mechanism, it's a way to tell the browser to enforce that you can't run code that could potentially be vulnerable to XSS, except in specific places that you designate with policies. This example was illuminating for me: https://developers.google.com/web/updates/2019/02/trusted-types#trusted-types https://developers.google.com/web/updates/2019/02/trusted-ty...

josteink 7y ago
Tomato/tomato. You are effectively saying that only certain types of strings and DOM structures are allowed on certain properties and attributes. This is perfectly encodable in a type-system. I don’t see a reason to dismiss that observation outright.

aflag 7y ago

As far as I know typescripts add types to JavaScript which will enforce tests for certain classes of programming errors. Trusted types is a custom validator for what is allowed to be assigned to innerHTML and the like. That check is done during runtime. Typescript doesn't prevent untrusted code from being infected, but hopefully your validator will.

koto1sa 7y ago
Exactly. That said, because the API itself is typed, it is possible to have the runtime enforcement also verified when statically type-checking your application code (e.g. that innerHTML is passed a TrustedHTML value, and not a string) in Flow, TypeScript or type-aware linters - like this: https://youtu.be/1KQngEZ8qH4?t=1330 https://youtu.be/1KQngEZ8qH4?t=1330