{"action":"created","issue":{"url":"https://api.github.com/repos/WICG/trusted-types/issues/63","repository_url":"https://api.github.com/repos/WICG/trusted-types","labels_url":"https://api.github.com/repos/WICG/trusted-types/issues/63/labels{/name}","comments_url":"https://api.github.com/repos/WICG/trusted-types/issues/63/comments","events_url":"https://api.github.com/repos/WICG/trusted-types/issues/63/events","html_url":"https://github.com/WICG/trusted-types/issues/63","id":334013804,"node_id":"MDU6SXNzdWUzMzQwMTM4MDQ=","number":63,"title":"Fallback policy support","user":{"login":"koto","id":128171,"node_id":"MDQ6VXNlcjEyODE3MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/128171?v=4","gravatar_id":"","url":"https://api.github.com/users/koto","html_url":"https://github.com/koto","followers_url":"https://api.github.com/users/koto/followers","following_url":"https://api.github.com/users/koto/following{/other_user}","gists_url":"https://api.github.com/users/koto/gists{/gist_id}","starred_url":"https://api.github.com/users/koto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/koto/subscriptions","organizations_url":"https://api.github.com/users/koto/orgs","repos_url":"https://api.github.com/users/koto/repos","events_url":"https://api.github.com/users/koto/events{/privacy}","received_events_url":"https://api.github.com/users/koto/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-20T10:19:14Z","updated_at":"2018-06-29T09:48:37Z","closed_at":null,"author_association":"COLLABORATOR","body":"Fallback policy is a single, exposed TT policy in the realm that gets called implicitly, when the DOM sink is used with a string. Example:\r\n\r\n```javascript\r\nTrustedTypes.createPolicy('fallback', (p) => {\r\n  p.createHTML = (s) => reallyConservativeSanitizer(s);\r\n  ...\r\n  p.expose = true;\r\n});\r\n\r\n// legacy code, e.g. in a widget\r\ndomElement.innerHTML = 'a string'; // will call 'fallback' policy underneath.\r\n```\r\n\r\nFallback policies fit well into the generic TT design, but it's unclear yet whether we should support them. \r\n\r\n**Pro**:\r\n* Substantially facilitates integration with existing codebase, especially when non-controlled code is used in a website (widgets, 3rd party libraries). For example, Google Analytics inserts a tracking image, and it's hard to expect Analytics to change. \r\n* Trivial to polyfill (it was introduced in #46, now disabled by default)\r\n\r\n**Con**:\r\n* Strong incentive to make the fallback policy liberal. It has to support all possible, functionally valid DOM interactions of all the runtime dependencies. In practice `reallyConservativeSanitizer` might break most applications, and the easiest solution is to make the fallback policy a no-op `(s) => s`.  This might become the equivalent of `unsafe-inline` - easy to adopt, but not improving the security posture.\r\n* As all exposed policies, it's harder to reason about its security, as its usage is spread throughout the whole application code. A liberal policy *might* not introduce vulnerabilities, but one can't tell that by looking at the policy alone.\r\n* No mechanism to control the usage of this policy (it has to be exposed)\r\n* Difficult to implement in the browsers (strings are blocked at the IDL level); @mikewest suggests this can be a userland implementation. "},"comment":{"url":"https://api.github.com/repos/WICG/trusted-types/issues/comments/401306693","html_url":"https://github.com/WICG/trusted-types/issues/63#issuecomment-401306693","issue_url":"https://api.github.com/repos/WICG/trusted-types/issues/63","id":401306693,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTMwNjY5Mw==","user":{"login":"koto","id":128171,"node_id":"MDQ6VXNlcjEyODE3MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/128171?v=4","gravatar_id":"","url":"https://api.github.com/users/koto","html_url":"https://github.com/koto","followers_url":"https://api.github.com/users/koto/followers","following_url":"https://api.github.com/users/koto/following{/other_user}","gists_url":"https://api.github.com/users/koto/gists{/gist_id}","starred_url":"https://api.github.com/users/koto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/koto/subscriptions","organizations_url":"https://api.github.com/users/koto/orgs","repos_url":"https://api.github.com/users/koto/repos","events_url":"https://api.github.com/users/koto/events{/privacy}","received_events_url":"https://api.github.com/users/koto/received_events","type":"User","site_admin":false},"created_at":"2018-06-29T09:48:37Z","updated_at":"2018-06-29T09:48:37Z","author_association":"COLLABORATOR","body":"The fallback behavior might ease adoption significantly. This may be implemented either as a static configuration (e.g. a set of CSP keywords promoting certain strings to typed values), or fully dynamic, with a policy. One example where this helps is #65 wih `url-allow-http` keyword. "}}
{"actor":{"display_login":"koto"}}