Improve test coverage of sink values

[lukewarlow]

We should ensure that we have exhaustive coverage of the "sink" value, this is the prefix for violation object samples, aswell as being one of the arguments for the default policy.

[lukewarlow]

Example change web-platform-tests/wpt#45058

[fred-wang]

Trusted Types spec:
https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts

HTML spec:
https://html.spec.whatwg.org/multipage/infrastructure.html#tt-trustedhtml
https://html.spec.whatwg.org/multipage/infrastructure.html#tt-trustedscript
https://html.spec.whatwg.org/multipage/infrastructure.html#tt-trustedscripturl

DOM spec:
whatwg/dom#1268

CSP spec:
https://w3c.github.io/webappsec-csp/#can-compile-strings

SVG spec (merged PR don't seem to show up on https://svgwg.org/svg2-draft):
w3c/svgwg#934

Service Workers spec:
https://w3c.github.io/ServiceWorker/#ref-for-dom-serviceworkercontainer-register

execCommand draft:
https://w3c.github.io/editing/docs/execCommand/#methods-to-query-and-execute-commands

Blink IDL: https://source.chromium.org/search?q=(TrustedHTML%20OR%20TrustedScript%20OR%20TrustedScriptURL%20OR%20TrustedType)%20AND%20filepath:third_party%2Fblink%2Frenderer%2Fcore%20AND%20file:idl&start=1

WebKit IDL: https://searchfox.org/wubkat/search?q=TrustedHTML%7CTrustedScriptURL%7CTrustedScript%7CTrustedType&path=.idl%24&case=false&regexp=true

Gecko IDL: https://searchfox.org/mozilla-central/search?q=TrustedHTML%7CTrustedScriptURL%7CTrustedScript%7CTrustedType&path=.webidl%24&case=false&regexp=true

Note that checking the IDL does not give the complete list of sinks, for example eval and function constructors ends up using https://w3c.github.io/webappsec-csp/#can-compile-strings

[fred-wang]

Trusted Types spec:

• HTMLScriptElement's innerText (TrustedScript)
• HTMLScriptElement's textContent (TrustedScript)
• HTMLScriptElement's src (TrustedScriptURL)
• HTMLScriptElement's text (TrustedScript)

HTML spec:

• Document's write() (TrustedHTML)
• Document's writeln() (TrustedHTML)
• Document's parseHTMLUnsafe() (TrustedHTML)
• HTMLIFrameElement's srcdoc (TrustedHTML)
• Document's setHTMLUnsafe()̀ (TrustedHTML`)
• Element's innerHTML (TrustedHTML)
• Element's outerHTML (TrustedHTML)
• Element's insertAdjacentHTML() (TrustedHTML)
• ShadowRoot's setHTMLUnsafe() (TrustedHTML)
• ShadowRoot's innerHTML (TrustedHTML)
• DOMParser's parseFromString()̀ (TrustedHTML`)
• Range's createContextualFragment() (TrustedHTML)
• eval() (TrustedScript)
• WindowOrWorkerGlobalScope's setTimeout() (TrustedScript)
• WindowOrWorkerGlobalScope's setInterval() (TrustedScript)
• WorkerGlobalScope's importScripts() (TrustedScriptURL)
• Worker's constructor (TrustedScriptURL)
• SharedWorker's constructor (TrustedScriptURL)

DOM spec:

• Element's setAttribute() (TrustedType)
• Element's setAttributeNS() (TrustedType)

CSP spec:

• eval() (TrustedScript)
• function constructor (TrustedScript)

SVG spec:

• SVGAnimatedString's baseVal (TrustedScriptURL) -- this seems essentially used for SVGScriptElement's href, but the spec status is a bit fuzzy.
• Luke mentioned SVGScriptElement should have similar script enforcement as HTML, but details are not specced yet. See SVGScriptElement needs TT protection too #483

Service Workers spec:

• ServiceWorkerContainer's register() (TrustedScriptURL)

execCommand draft:

• Document's execCommand() (TrustedHTML)

[lukewarlow]

There's also SVGScriptElement which needs handling it's just not specced yet

[fred-wang]

@lukewarlow yes I noticed that. It seems some PRs have been merged but are still not public. will follow-up with you privately

[fred-wang]

#494 (comment) should now be an up-to-date list of existing sinks. Still need to check whether we cover everything. The state of the SVG spec is still not great, but essentially we would make SVGScriptElement behave similarly to HTMLScriptElement.

Everything that is implemented in Gecko or WebKit is covered by one of the spec at #494 (comment) but Chromium still seems to implement legacy stuff (probably we should write some tests to verify these are not valid sinks):

https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/dom/child_node_part.idl?q=(TrustedHTML%20OR%20TrustedScript%20OR%20TrustedScriptURL%20OR%20TrustedType)%20AND%20filepath:third_party%2Fblink%2Frenderer%2Fcore%20AND%20file:idl&start=11
https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/dom/parent_node.idl?q=(TrustedHTML%20OR%20TrustedScript%20OR%20TrustedScriptURL%20OR%20TrustedType)%20AND%20filepath:third_party%2Fblink%2Frenderer%2Fcore%20AND%20file:idl&start=11
https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/dom/child_node.idl?q=(TrustedHTML%20OR%20TrustedScript%20OR%20TrustedScriptURL%20OR%20TrustedType)%20AND%20filepath:third_party%2Fblink%2Frenderer%2Fcore%20AND%20file:idl&start=11