Bug 273187 - Block Function constructor string arguments when trusted types enforced
Summary: Block Function constructor string arguments when trusted types enforced
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari 17
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Luke Warlow
URL:
Keywords: InRadar
Depends on:
Blocks: 267694
  Show dependency tree / graph
 
Reported: 2024-04-24 07:51 PDT by Luke Warlow
Modified: 2024-05-30 03:36 PDT (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Luke Warlow 2024-04-24 07:51:14 PDT 
When trusted types are enforced string arguments to new Function() should be blocked unless the default policy exists and allows them.
Comment 1 Luke Warlow 2024-04-29 09:50:07 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/27878
Comment 2 Radar WebKit Bug Importer 2024-05-01 07:52:15 PDT 
<rdar://problem/127361257>