From dda36769ae010bcb176f17e28e70b29c7db24375 Mon Sep 17 00:00:00 2001 From: ldm0 Date: Mon, 14 Sep 2026 16:04:24 +0800 Subject: [PATCH] fix(webapi): adapt Trusted Types and worker security bindings Identify Trusted Types through shared native interface identities and validate imported Worker script responses through the complete-head API. Preserve the initiating origin, mode, credentials and security policy. Validation: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast (18011 passed, 13 skipped). --- .../src/context_bootstrap/trusted_types.rs | 10 +++------- .../src/worker/global_scope/import_scripts.rs | 8 +++----- 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/moli-renderer-v8/src/context_bootstrap/trusted_types.rs b/moli-renderer-v8/src/context_bootstrap/trusted_types.rs index 089dedfb32..d246d0d732 100644 --- a/moli-renderer-v8/src/context_bootstrap/trusted_types.rs +++ b/moli-renderer-v8/src/context_bootstrap/trusted_types.rs @@ -705,13 +705,9 @@ pub(crate) fn trusted_type_kind<'s>( value: v8::Local<'s, v8::Value>, ) -> Option { let object = v8::Local::::try_from(value).ok()?; - let kind = get_private_value(scope, object, TRUSTED_TYPE_KIND_SLOT)?; - match kind.to_string(scope)?.to_rust_string_lossy(scope).as_str() { - "html" => Some(TrustedTypeKind::Html), - "script" => Some(TrustedTypeKind::Script), - "script-url" => Some(TrustedTypeKind::ScriptUrl), - _ => None, - } + TRUSTED_TYPE_KINDS + .into_iter() + .find(|kind| kind.interface().is_instance(scope, object)) } pub(crate) fn trusted_type_string<'s>( diff --git a/moli-renderer-v8/src/worker/global_scope/import_scripts.rs b/moli-renderer-v8/src/worker/global_scope/import_scripts.rs index 9fece7112f..39039afe3d 100644 --- a/moli-renderer-v8/src/worker/global_scope/import_scripts.rs +++ b/moli-renderer-v8/src/worker/global_scope/import_scripts.rs @@ -241,11 +241,9 @@ pub(super) fn fetch_worker_import_source_blocking( response.body_bytes(), )?; if let Some(initiator_url) = &request_initiator_url { - validate_fetch_response_security_policy_for_origin( - initiator_url, - &WebOrigin::from_url(initiator_url), - &response.final_url, - &response.headers, + validate_fetch_response_security_policy( + WebOrigin::from_url(initiator_url), + &response.head(), RequestMode::NoCors, RequestCredentialsMode::SameOrigin, policy_context,