FF145 Relnote: Trusted Types early beta #41518

hamishwillee · 2025-10-14T02:09:17Z

FF145 supports Trusted Types in early beta in https://bugzilla.mozilla.org/show_bug.cgi?id=1992941

This adds a release note, experimental feature, and updates the API overview page.

This is a minimal update to provide a coherent story, with links to most affected interfaces. There are still quite a few interfaces that actually need updates but they will come in follow on PRs.

Related work can be tracked in #41507

files/en-us/mozilla/firefox/releases/145/index.md

github-actions · 2025-10-14T02:10:53Z

Preview URLs

Flaws (26)

Note! 2 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Mozilla/Firefox/Experimental_features
Title: Experimental features in Firefox
Flaw count: 19

macros:
- Macro produces link /en-US/docs/Web/CSS/initial-letter which is a redirect
- Macro produces link /en-US/docs/Web/CSS/width which is a redirect
- Macro produces link /en-US/docs/Web/CSS/scroll-timeline-name which is a redirect
- Macro produces link /en-US/docs/Web/CSS/scroll-timeline-axis which is a redirect
- Macro produces link /en-US/docs/Web/CSS/scroll-timeline which is a redirect
- and 14 more flaws omitted

URL: /en-US/docs/Mozilla/Firefox/Releases/145
Title: Firefox 145 release notes for developers (Beta)
Flaw count: 4

macros:
- Macro produces link /en-US/docs/Web/CSS/text-autospace which is a redirect
- Macro produces link /en-US/docs/Web/CSS/width which is a redirect
- Macro produces link /en-US/docs/Web/CSS/height which is a redirect
- Macro produces link /en-US/docs/Web/CSS/text-decoration which is a redirect

URL: /en-US/docs/Web/HTTP/Guides/CSP
Title: Content Security Policy (CSP)
Flaw count: 3

unknown:
- No generic content config found
- no blog root
- no blog root

External URLs (2)

URL: /en-US/docs/Mozilla/Firefox/Experimental_features
Title: Experimental features in Firefox

https://bugzil.la/1992941 (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Mozilla/Firefox/Releases/145
Title: Firefox 145 release notes for developers (Beta)

https://bugzil.la/1976656 (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2025-10-31 05:53:22)

files/en-us/web/api/trusted_types_api/index.md

github-actions · 2025-10-24T07:40:03Z

This pull request has merge conflicts that must be resolved before it can be merged.

github-actions · 2025-10-27T10:42:40Z

This pull request has merge conflicts that must be resolved before it can be merged.

github-actions · 2025-10-30T10:27:19Z

This pull request has merge conflicts that must be resolved before it can be merged.

files/en-us/web/api/trusted_types_api/index.md

hamishwillee · 2025-10-31T05:53:16Z

files/en-us/web/api/trusted_types_api/index.md

+
+## Injection sink interfaces
+
+This section provides an list of "direct" injection sink interfaces.


FYI this is an exhaustive list of direct injection sinks, taken from @fred-wang compiled list in w3c/trusted-types#494 (comment).

This is linked from the first mention of injection sinks and the release note.

hamishwillee · 2025-10-31T05:55:44Z

files/en-us/web/api/trusted_types_api/index.md

+Note that there are cases where untrusted strings may be "indirectly injected", such as when an untrusted string is added as the child node of a script element, and then the element is added to the document.
+These cases are evaluated the untrusted script is added to the document.


This follows on from discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=1992941#c6 and earlier in https://bugzilla.mozilla.org/show_bug.cgi?id=1928932#c22

There are cases where you can't know on assignment that an untrusted string will be used somewhere where it matters. For those cases the TT checks are run when (say) the script is injected.
This probably requires a section of its own with concrete example (see second link above).
For now, I am doing this. I hope to come back to this and expand this section, but perhaps not before the Firefox release.

Super, thanks for documenting.

hamishwillee · 2025-10-31T05:57:45Z

@bsmth Would appreciate a review sooner rather than later if you could. @wbamberg I'd happily have review from you also - essentially to check you don't mind where I put the list of injection sinks.

bsmth · 2025-10-31T10:11:30Z

files/en-us/mozilla/firefox/experimental_features/index.md

 ### Trusted Types API

 The [Trusted Types API](/en-US/docs/Web/API/Trusted_Types_API) provides mechanisms to ensure that functions that can potentially be used as vectors for XSS attacks are only able to be called with data that has been validated or sanitized.
+The API has been implemented and is enabled in early beta releases ([Firefox bug 1992941](https://bugzil.la/1992941)).


Suggested change

The API has been implemented and is enabled in early beta releases ([Firefox bug 1992941](https://bugzil.la/1992941)).

The API is enabled in early beta releases ([Firefox bug 1992941](https://bugzil.la/1992941)).

bsmth · 2025-10-31T10:12:31Z

files/en-us/mozilla/firefox/experimental_features/index.md

- The {{domxref("Window.setInterval()")}} and {{domxref("Window.setTimeout()")}} methods can be called with a {{domxref("TrustedScript")}}. ([Firefox bug 1931290](https://bugzil.la/1931290)).
- The global [`trustedTypes`](/en-US/docs/Web/API/Window/trustedTypes) property is available for accessing the Trusted Types API.
- The properties {{domxref("Element.innerHTML")}} and {{domxref("ShadowRoot.innerHTML")}} can be called with [trusted types](/en-US/docs/Web/API/Trusted_Types_API).
+- Addition of new interfaces {{domxref("TrustedTypePolicyFactory")}}, {{domxref("TrustedTypePolicy")}}, {{domxref("TrustedHTML")}}, {{domxref("TrustedScript")}}, {{domxref("TrustedScriptURL")}}, and the `trustedTypes` property on {{domxref("Window/trustedTypes", "Window")}} and {{domxref("WorkerGlobalScope/trustedTypes", "WorkerGlobalScope")}}.


Suggested change

- Addition of new interfaces {{domxref("TrustedTypePolicyFactory")}}, {{domxref("TrustedTypePolicy")}}, {{domxref("TrustedHTML")}}, {{domxref("TrustedScript")}}, {{domxref("TrustedScriptURL")}}, and the `trustedTypes` property on {{domxref("Window/trustedTypes", "Window")}} and {{domxref("WorkerGlobalScope/trustedTypes", "WorkerGlobalScope")}}.

- Addition of the {{domxref("TrustedTypePolicyFactory")}}, {{domxref("TrustedTypePolicy")}}, {{domxref("TrustedHTML")}}, {{domxref("TrustedScript")}}, {{domxref("TrustedScriptURL")}} interfaces and the `trustedTypes` property on {{domxref("Window/trustedTypes", "Window")}} and {{domxref("WorkerGlobalScope/trustedTypes", "WorkerGlobalScope")}}.

bsmth · 2025-10-31T10:13:14Z

files/en-us/mozilla/firefox/releases/145/index.md

+
+- **Trusted Types API** for scripts (Nightly/Early Beta): `dom.security.trusted_types.enabled`
+
+  The [Trusted Types API](/en-US/docs/Web/API/Trusted_Types_API) is now fully implemented. ([Firefox bug 1976656](https://bugzil.la/1976656)).


Suggested change

The [Trusted Types API](/en-US/docs/Web/API/Trusted_Types_API) is now fully implemented. ([Firefox bug 1976656](https://bugzil.la/1976656)).

The [Trusted Types API](/en-US/docs/Web/API/Trusted_Types_API) is now enabled in early beta releases. ([Firefox bug 1976656](https://bugzil.la/1976656)).

bsmth · 2025-10-31T10:14:04Z

files/en-us/mozilla/firefox/releases/145/index.md

+  The [Trusted Types API](/en-US/docs/Web/API/Trusted_Types_API) is now fully implemented. ([Firefox bug 1976656](https://bugzil.la/1976656)).
+
+  The changes include:
+  - Addition of new interfaces {{domxref("TrustedTypePolicyFactory")}}, {{domxref("TrustedTypePolicy")}}, {{domxref("TrustedHTML")}}, {{domxref("TrustedScript")}}, {{domxref("TrustedScriptURL")}}, and the `trustedTypes` property on {{domxref("Window/trustedTypes", "Window")}} and {{domxref("WorkerGlobalScope/trustedTypes", "WorkerGlobalScope")}}


Same suggestions as above if you like them.

bsmth · 2025-10-31T10:15:33Z

files/en-us/web/http/guides/csp/index.md

+The `unsafe-eval` keyword can be used to override this behavior, and as with `unsafe-inline`, and for the same reasons: **developers should avoid `unsafe-eval`**.
+
+Sometimes it can be difficult to remove usages of `eval()` and the other methods: in these situations, the [Trusted Types API](/en-US/docs/Web/API/Trusted_Types_API) can make it safer, by ensuring that the input meets a defined policy.
+The `trusted-types-eval` keyword should be used to override the behavior in this case!


Suggested change

The `trusted-types-eval` keyword should be used to override the behavior in this case!

The `trusted-types-eval` keyword should be used to override the behavior in this case.

Or we could drop this para in a note block if you think we should highlight it?

bsmth

Nice, a couple of suggestions for you, but ready to go when you've had a look 👀

wbamberg · 2025-10-31T18:06:01Z

@bsmth Would appreciate a review sooner rather than later if you could. @wbamberg I'd happily have review from you also - essentially to check you don't mind where I put the list of injection sinks.

It's great to see the list of sinks. We talked about this back in #37917 (comment). Personally I would probably have had it as an H3 at the end of "Concepts and usage", just because I feel like everything after that point is kind of formal ("items defined in this specification") and it's more helpful to characterize it as a list of injection sinks (which you have done, but that doesn't fit this formal structure).

What I mean by formal is really, the same format for every API overview page (and theoretically possible to generate from the IDL). This is generally two things:

interfaces defined in this specification
additions to other interfaces

Technically the list of injection sinks is "additions to other interfaces" of course. But it's much more helpful to frame them as a list of injection sinks. But that's not a formal description available in API overview pages.

Anyway, that's my thinking. But it's much better to have the list than not, and I could appreciate that my complaint here is pretty niche, so I won't argue with what you have here.

github-actions bot added Content:WebAPI Web API docs Content:Firefox Content in the Mozilla/Firefox subtree size/m [PR only] 51-500 LoC changed labels Oct 14, 2025

github-actions bot reviewed Oct 14, 2025

View reviewed changes

files/en-us/mozilla/firefox/releases/145/index.md Outdated Show resolved Hide resolved

hamishwillee mentioned this pull request Oct 14, 2025

[WebAPI] Enable Trusted Types in early beta #41507

Open

8 tasks

hamishwillee commented Oct 14, 2025

View reviewed changes

files/en-us/web/api/trusted_types_api/index.md Outdated Show resolved Hide resolved

github-actions bot added the merge conflicts 🚧 [PR only] label Oct 24, 2025

hamishwillee force-pushed the ff145rel_tt_early_beta branch from 05e5fd2 to 0b6363d Compare October 27, 2025 01:39

github-actions bot added merge conflicts 🚧 [PR only] and removed merge conflicts 🚧 [PR only] labels Oct 27, 2025

hamishwillee force-pushed the ff145rel_tt_early_beta branch from 0b6363d to ddde1a0 Compare October 28, 2025 04:06

github-actions bot removed the merge conflicts 🚧 [PR only] label Oct 28, 2025

hamishwillee force-pushed the ff145rel_tt_early_beta branch from ddde1a0 to 6637909 Compare October 28, 2025 06:15

github-actions bot added Content:HTTP HTTP docs merge conflicts 🚧 [PR only] labels Oct 28, 2025

hamishwillee added 3 commits October 31, 2025 14:13

FF145 Relnote: Trusted Types early beta

a586cfe

trusted-types-eval - add

16cf6c0

Add more items to trusted types sinks

1578ce4

hamishwillee force-pushed the ff145rel_tt_early_beta branch from 6637909 to 1578ce4 Compare October 31, 2025 05:35

github-actions bot removed the merge conflicts 🚧 [PR only] label Oct 31, 2025

github-actions bot reviewed Oct 31, 2025

View reviewed changes

files/en-us/web/api/trusted_types_api/index.md Outdated Show resolved Hide resolved

Add note about indirect injection

8d2f1d9

hamishwillee commented Oct 31, 2025

View reviewed changes

hamishwillee marked this pull request as ready for review October 31, 2025 05:57

hamishwillee requested a review from a team as a code owner October 31, 2025 05:57

hamishwillee requested review from a team as code owners October 31, 2025 05:57

hamishwillee requested review from bsmth and removed request for a team October 31, 2025 05:57

sideshowbarker removed request for a team October 31, 2025 06:01

bsmth reviewed Oct 31, 2025

View reviewed changes

bsmth approved these changes Oct 31, 2025

View reviewed changes


		## Injection sink interfaces

		This section provides an list of "direct" injection sink interfaces.

		Note that there are cases where untrusted strings may be "indirectly injected", such as when an untrusted string is added as the child node of a script element, and then the element is added to the document.
		These cases are evaluated the untrusted script is added to the document.

	The API has been implemented and is enabled in early beta releases ([Firefox bug 1992941](https://bugzil.la/1992941)).
	The API is enabled in early beta releases ([Firefox bug 1992941](https://bugzil.la/1992941)).

	- Addition of new interfaces {{domxref("TrustedTypePolicyFactory")}}, {{domxref("TrustedTypePolicy")}}, {{domxref("TrustedHTML")}}, {{domxref("TrustedScript")}}, {{domxref("TrustedScriptURL")}}, and the `trustedTypes` property on {{domxref("Window/trustedTypes", "Window")}} and {{domxref("WorkerGlobalScope/trustedTypes", "WorkerGlobalScope")}}.
	- Addition of the {{domxref("TrustedTypePolicyFactory")}}, {{domxref("TrustedTypePolicy")}}, {{domxref("TrustedHTML")}}, {{domxref("TrustedScript")}}, {{domxref("TrustedScriptURL")}} interfaces and the `trustedTypes` property on {{domxref("Window/trustedTypes", "Window")}} and {{domxref("WorkerGlobalScope/trustedTypes", "WorkerGlobalScope")}}.


		- Trusted Types API for scripts (Nightly/Early Beta): `dom.security.trusted_types.enabled`

		The [Trusted Types API](/en-US/docs/Web/API/Trusted_Types_API) is now fully implemented. ([Firefox bug 1976656](https://bugzil.la/1976656)).

	The `trusted-types-eval` keyword should be used to override the behavior in this case!
	The `trusted-types-eval` keyword should be used to override the behavior in this case.

FF145 Relnote: Trusted Types early beta #41518

Are you sure you want to change the base?

FF145 Relnote: Trusted Types early beta #41518

Conversation

hamishwillee commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 24, 2025

Uh oh!

github-actions bot commented Oct 27, 2025

Uh oh!

github-actions bot commented Oct 30, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hamishwillee commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bsmth Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bsmth left a comment

Choose a reason for hiding this comment

Uh oh!

wbamberg commented Oct 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hamishwillee commented Oct 14, 2025 •

edited

Loading

github-actions bot commented Oct 14, 2025 •

edited

Loading

hamishwillee commented Oct 31, 2025 •

edited

Loading

bsmth Oct 31, 2025 •

edited

Loading