w3c spec: https://w3c.github.io/trusted-types/dist/spec/
tc39 spec: https://github.com/tc39/proposal-dynamic-code-brand-checks (stage 3 so okay to implement)
Currently eval(notString) returns notString as-is. Brand checks mean eval() calls an embedder callback to determine if it should evaluate notString instead.
The security angle is that embedders can then lock down plain eval() to disallow arbitrary strings and only accept trusted objects.
If we add something like V8's private symbols (symbols visible to the embedder but not JS), then it's trivial to implement trusted objects: trusted if it has some embedder-defined private symbol, untrusted if not.
We already use JS_ATOM_TYPE_PRIVATE atoms internally (for brand checks, as it turns out), it just needs a public C API but that's easy.
w3c spec: https://w3c.github.io/trusted-types/dist/spec/
tc39 spec: https://github.com/tc39/proposal-dynamic-code-brand-checks (stage 3 so okay to implement)
Currently
eval(notString)returnsnotStringas-is. Brand checks meaneval()calls an embedder callback to determine if it should evaluatenotStringinstead.The security angle is that embedders can then lock down plain eval() to disallow arbitrary strings and only accept trusted objects.
If we add something like V8's private symbols (symbols visible to the embedder but not JS), then it's trivial to implement trusted objects: trusted if it has some embedder-defined private symbol, untrusted if not.
We already use
JS_ATOM_TYPE_PRIVATEatoms internally (for brand checks, as it turns out), it just needs a public C API but that's easy.