287158 2025-02-06 08:34:16 -0800 It is possible to have the same Attr node in multiple Elements with Trusted Types default policy 2025-02-18 12:04:39 -0800 1 1 1 Unclassified WebKit DOM Other Unspecified Unspecified RESOLVED FIXED https://github.com/web-platform-tests/wpt/pull/50532 InRadar P2 Normal --- 266630 1 lwarlow lwarlow webkit-bug-importer oldest_to_newest 2092453 0 lwarlow 2025-02-06 08:34:16 -0800 ``` <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'"> </head> <body> <h3 id="log"></h3> <script> var attr = document.createAttribute("onclick"); attr.value = "1+1;"; var gotCreateScript = false; trustedTypes.createPolicy("default", { createScript: function(val) { if (gotCreateScript) { // We move the Attr node only the first time this is called. return val; } gotCreateScript = true; document.documentElement.setAttributeNode(attr); return val; }, }); document.body.setAttributeNode(attr); document.getElementById("log").textContent = "Does html and body element have the same Attr node in their attributes list: " + (document.documentElement.attributes[0] === document.body.attributes[0]); </script> </body> </html> ``` By using trusted types callbacks it is possible to move Attr node to another element while it is still being set on the original element. Some discussion also in https://github.com/whatwg/dom/pull/1268 2092469 1 lwarlow 2025-02-06 09:19:58 -0800 Pull request: https://github.com/WebKit/WebKit/pull/40127 2094463 2 webkit-bug-importer 2025-02-13 08:35:15 -0800 <rdar://problem/144789108> 2095531 3 ews-feeder 2025-02-18 12:04:37 -0800 Committed 290543@main (4dad722e68b5): <https://commits.webkit.org/290543@main> Reviewed commits have been landed. Closing PR #40127 and removing active labels.