RESOLVED FIXED287158
It is possible to have the same Attr node in multiple Elements with Trusted Types default policy 
https://bugs.webkit.org/show_bug.cgi?id=287158
Summary It is possible to have the same Attr node in multiple Elements with Trusted T...
Luke Warlow
Reported 2025-02-06 08:34:16 PST
``` <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'"> </head> <body> <h3 id="log"></h3> <script> var attr = document.createAttribute("onclick"); attr.value = "1+1;"; var gotCreateScript = false; trustedTypes.createPolicy("default", { createScript: function(val) { if (gotCreateScript) { // We move the Attr node only the first time this is called. return val; } gotCreateScript = true; document.documentElement.setAttributeNode(attr); return val; }, }); document.body.setAttributeNode(attr); document.getElementById("log").textContent = "Does html and body element have the same Attr node in their attributes list: " + (document.documentElement.attributes[0] === document.body.attributes[0]); </script> </body> </html> ``` By using trusted types callbacks it is possible to move Attr node to another element while it is still being set on the original element. Some discussion also in https://github.com/whatwg/dom/pull/1268
Attachments
Add attachment proposed patch, testcase, etc.
Luke Warlow
Comment 1 2025-02-06 09:19:58 PST
Pull request: https://github.com/WebKit/WebKit/pull/40127
Radar WebKit Bug Importer
Comment 2 2025-02-13 08:35:15 PST
<rdar://problem/144789108>
EWS
Comment 3 2025-02-18 12:04:37 PST
Committed 290543@main (4dad722e68b5): <https://commits.webkit.org/290543@main> Reviewed commits have been landed. Closing PR #40127 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.