From a925e4f9c6c5f9a6a012664c6f0bf95e88ade59a Mon Sep 17 00:00:00 2001
From: Krzysztof Kotowicz <koto@google.com>
Date: Tue, 16 Jan 2024 12:07:17 +0000
Subject: [PATCH] Merged HTML parsing sinks with DOM XSS sinks. (#407)

SHA: e8fb14f0d836a84217ddfe3d534eaf08f31f17c3
Reason: push, by koto

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 dist/spec/index.html | 84 ++++++++++++++++++++------------------------
 1 file changed, 39 insertions(+), 45 deletions(-)

diff --git a/dist/spec/index.html b/dist/spec/index.html
index 0ecf303..0825e19 100644
--- a/dist/spec/index.html
+++ b/dist/spec/index.html
@@ -7,7 +7,7 @@
   <link href="https://www.w3.org/StyleSheets/TR/2021/W3C-ED" rel="stylesheet">
   <meta content="Bikeshed version 82ce88815, updated Thu Sep 7 16:33:55 2023 -0700" name="generator">
   <link href="https://w3c.github.io/trusted-types/dist/spec/" rel="canonical">
-  <meta content="177fad39554ab56bb433602f92fee76196d0cde2" name="document-revision">
+  <meta content="e8fb14f0d836a84217ddfe3d534eaf08f31f17c3" name="document-revision">
 <style>/* Boilerplate: style-autolinks */
 .css.css, .property.property, .descriptor.descriptor {
     color: var(--a-normal-text);
@@ -868,7 +868,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1 class="p-name no-ref" id="title">Trusted Types</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-01-15">15 January 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-01-16">16 January 2024</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -934,8 +934,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
       <li>
        <a href="#injection-sinks"><span class="secno">2.1</span> <span class="content">Injection sinks</span></a>
        <ol class="toc">
-        <li><a href="#html-injection-sinks"><span class="secno">2.1.1</span> <span class="content">HTML injection sinks</span></a>
-        <li><a href="#dom-xss-injection-sinks"><span class="secno">2.1.2</span> <span class="content">DOM XSS injection sinks</span></a>
+        <li><a href="#dom-xss-injection-sinks"><span class="secno">2.1.1</span> <span class="content">DOM XSS injection sinks</span></a>
        </ol>
       <li>
        <a href="#trusted-types"><span class="secno">2.2</span> <span class="content">Trusted Types</span></a>
@@ -1073,7 +1072,7 @@ <h2 class="heading settled" data-level="1" id="introduction"><span class="secno"
 that potentially can trigger a vulnerability, depending on a value
 of <code>foo</code> and <code>bar</code>.</p>
    <p>This document focuses on preventing DOM-Based Cross-Site Scripting
-that occurs when attacker-controlled data reaches <a href="#dom-xss-injection-sinks">§ 2.1.2 DOM XSS injection sinks</a>, as that eventually causes execution of the
+that occurs when attacker-controlled data reaches <a href="#dom-xss-injection-sinks">§ 2.1.1 DOM XSS injection sinks</a>, as that eventually causes execution of the
 script payload controlled by the attacker. DOM XSS is prevalent in the
 web applications as there are over 60 different
 injection sinks (e.g. <code>Element.innerHTML</code>, or <code>Location.href</code> setters).</p>
@@ -1133,7 +1132,7 @@ <h3 class="heading settled" data-level="1.3" id="use-cases"><span class="secno">
 libraries that perform auxiliary tasks (e.g. analytics, performance
 monitoring). To ensure that none of these components introduce DOM
 XSS vulnerabilities, author defines a Trusted Type policy in the
-templating library and enables the enforcement for the <a href="#dom-xss-injection-sinks">§ 2.1.2 DOM XSS injection sinks</a>.</p>
+templating library and enables the enforcement for the <a href="#dom-xss-injection-sinks">§ 2.1.1 DOM XSS injection sinks</a>.</p>
     <li data-md>
      <p>A large team maintains a complex client-side application.
 They create a number of Trusted Types policies that satisfy the security
@@ -1144,14 +1143,14 @@ <h3 class="heading settled" data-level="1.3" id="use-cases"><span class="secno">
      <p>The need to create trusted values to affect <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink①">injection sinks</a>,
 combined with additional scrutiny on changes that affect policy
 code, incents developers to use safe abstractions instead of writing ad-hoc
-string composition code when interacting with <a href="#dom-xss-injection-sinks">§ 2.1.2 DOM XSS injection sinks</a>.</p>
+string composition code when interacting with <a href="#dom-xss-injection-sinks">§ 2.1.1 DOM XSS injection sinks</a>.</p>
      <p>When considering the risk of DOM XSS, security auditors find a
 small attack surface; they focus on the small amount of code that
 crafts the CSP header and provides the safe abstractions, and ignore the
 bulk of client-side application code.</p>
     <li data-md>
      <p>An existing web application interacts with the DOM mostly using XSS-safe
-patterns (i.e. without using <a href="#dom-xss-injection-sinks">§ 2.1.2 DOM XSS injection sinks</a>). In a few places,
+patterns (i.e. without using <a href="#dom-xss-injection-sinks">§ 2.1.1 DOM XSS injection sinks</a>). In a few places,
 however, it resorts to using risky patterns like loading additional script using
 JSONP, calling into <code>innerHTML</code> or <code>eval</code>.</p>
      <p>Review finds that those places do not cause XSS (e.g. because
@@ -1194,25 +1193,11 @@ <h3 class="heading settled" data-level="2.1" id="injection-sinks"><span class="s
 it’s not easy to distinguish one from the other.</p>
    <p>This document organizes the injection sinks into groups, based on the
 capabilities that sinks in a given group have. <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement①">Enforcement</a> for groups is controlled via <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group">trusted-types-sink-group</a> values.</p>
-   <h4 class="heading settled" data-level="2.1.1" id="html-injection-sinks"><span class="secno">2.1.1. </span><span class="content">HTML injection sinks</span><a class="self-link" href="#html-injection-sinks"></a></h4>
+   <h4 class="heading settled" data-level="2.1.1" id="dom-xss-injection-sinks"><span class="secno">2.1.1. </span><span class="content">DOM XSS injection sinks</span><a class="self-link" href="#dom-xss-injection-sinks"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>HTML <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink③">injection sinks</a> parse input strings into a DOM tree. Since HTML parsers
-can create arbitrary elements, including scripts, and set arbitrary attributes,
-enabling the <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement②">enforcement</a> of any <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group①">trusted-types-sink-group</a> also implies
-enforcing types for HTML injection sinks.</p>
-   <p>Examples of HTML injection sinks include:</p>
-   <ul>
-    <li data-md>
-     <p>Functions that parse &amp; insert HTML strings into the document like <code class="idl"><a data-link-type="idl" href="#dom-innerhtml-innerhtml" id="ref-for-dom-innerhtml-innerhtml">Element.innerHTML</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-element-outerhtml" id="ref-for-dom-element-outerhtml">Element.outerHTML</a></code> setter, or <code class="idl"><a data-link-type="idl" href="#dom-document-write" id="ref-for-dom-document-write">Document.write</a></code>.</p>
-    <li data-md>
-     <p>Functions that create a new same-origin <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code> with caller-controlled
-markup like <code class="idl"><a data-link-type="idl" href="#dom-domparser-parsefromstring" id="ref-for-dom-domparser-parsefromstring">parseFromString()</a></code>,</p>
-   </ul>
-   <h4 class="heading settled" data-level="2.1.2" id="dom-xss-injection-sinks"><span class="secno">2.1.2. </span><span class="content">DOM XSS injection sinks</span><a class="self-link" href="#dom-xss-injection-sinks"></a></h4>
-   <p><em>This section is not normative.</em></p>
-   <p>DOM XSS <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink④">injection sinks</a> evaluate an input string value in a way that could
+   <p>DOM XSS <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink③">injection sinks</a> evaluate an input string value in a way that could
 result in DOM XSS if that value is untrusted.</p>
-   <p>Examples of include:</p>
+   <p>Examples include:</p>
    <ul>
     <li data-md>
      <p>Setters for <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#element" id="ref-for-element">Element</a></code> attributes that accept a URL of the code to load
@@ -1224,7 +1209,16 @@ <h4 class="heading settled" data-level="2.1.2" id="dom-xss-injection-sinks"><spa
     <li data-md>
      <p>Navigation to 'javascript:' URLs.</p>
    </ul>
-   <p>Guarding DOM XSS injection sinks is controlled by the <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group②">trusted-types-sink-group</a> named 'script'.</p>
+   <p>Since HTML parsers can create arbitrary elements, including scripts, and set arbitrary attributes,
+DOM XSS <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink④">injection sinks</a> also include HTML parsing sinks:</p>
+   <ul>
+    <li data-md>
+     <p>Functions that parse &amp; insert HTML strings into the document like <code class="idl"><a data-link-type="idl" href="#dom-innerhtml-innerhtml" id="ref-for-dom-innerhtml-innerhtml">Element.innerHTML</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-element-outerhtml" id="ref-for-dom-element-outerhtml">Element.outerHTML</a></code> setter, or <code class="idl"><a data-link-type="idl" href="#dom-document-write" id="ref-for-dom-document-write">Document.write</a></code>.</p>
+    <li data-md>
+     <p>Functions that create a new same-origin <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code> with caller-controlled
+markup like <code class="idl"><a data-link-type="idl" href="#dom-domparser-parsefromstring" id="ref-for-dom-domparser-parsefromstring">parseFromString()</a></code>.</p>
+   </ul>
+   <p>Guarding DOM XSS injection sinks is controlled by the <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group①">trusted-types-sink-group</a> named 'script'.</p>
    <h3 class="heading settled" data-level="2.2" id="trusted-types"><span class="secno">2.2. </span><span class="content">Trusted Types</span><a class="self-link" href="#trusted-types"></a></h3>
    <p>To allow the authors to control values reaching injection sinks,
 we introduce <a href="#trusted-types">§ 2.2 Trusted Types</a>. The following list of <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="trusted-type">Trusted Type</dfn>s indicating that a given value is
@@ -1351,12 +1345,12 @@ <h3 class="heading settled" data-level="2.3" id="policies-hdr"><span class="secn
 myLibrary<c- p>.</c->init<c- p>({</c->policy<c- o>:</c-> cdnScriptsPolicy<c- p>});</c->
 </pre>
    </div>
-   <p class="note" role="note"><span class="marker">Note:</span> Trusted Type objects can only be created via policies. If <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement③">enforcement</a> is enabled, only the policy code can trigger an action
+   <p class="note" role="note"><span class="marker">Note:</span> Trusted Type objects can only be created via policies. If <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement②">enforcement</a> is enabled, only the policy code can trigger an action
 of an <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink①⓪">injection sink</a> and hence call-sites of the policies' <code>create*</code> functions are the <em>only</em> security-sensitive code in the entire program
 with regards to the actions of the <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink①①">injection sinks</a>.
 Only this typically small subset of the entire code base needs to be
 security-reviewed - there’s no need to monitor or review
-the <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink①②">injection sinks</a> themselves, as User Agents <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement④">enforce</a> that
+the <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink①②">injection sinks</a> themselves, as User Agents <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement③">enforce</a> that
 those sinks will only accept matching Trusted Type objects, and these in turn
 can only be created via policies.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="#dom-trustedtypepolicyfactory-createpolicy" id="ref-for-dom-trustedtypepolicyfactory-createpolicy">createPolicy</a></code> function returns a policy object which <code>create*</code> functions
@@ -1682,7 +1676,7 @@ <h4 class="heading settled" data-level="2.3.4" id="default-policy-hdr"><span cla
 returns <em>null</em> or <em>undefined</em>, it will cause a CSP violation. In the
 enforcing mode, an error will be thrown, but in report-only the original value
 passed to the default policy will be used.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> This optional behavior allows for introducing Trusted Type <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement⑤">enforcement</a> to applications that are still using legacy code that uses injection sinks.
+   <p class="note" role="note"><span class="marker">Note:</span> This optional behavior allows for introducing Trusted Type <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement④">enforcement</a> to applications that are still using legacy code that uses injection sinks.
 Needless to say, this policy should
 necessarily be defined with very strict rules not to bypass the security
 restrictions in unknown parts of the application. In an extreme
@@ -1848,14 +1842,14 @@ <h3 class="heading settled" data-level="3.4" id="check-templatedness-algorithm">
    </ol>
    <h3 class="heading settled" data-level="3.5" id="get-trusted-type-compliant-string-algorithm"><span class="secno">3.5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="abstract-op" data-export id="abstract-opdef-get-trusted-type-compliant-string">Get Trusted Type compliant string</dfn></span><a class="self-link" href="#get-trusted-type-compliant-string-algorithm"></a></h3>
    <p>This algorithm will return a string that can be used with an <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink①⑨">injection sink</a>, optionally unwrapping it from a matching <a data-link-type="dfn" href="#trusted-type" id="ref-for-trusted-type④">Trusted Type</a>.
-It will ensure that the Trusted Type <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement⑥">enforcement</a> rules were respected.</p>
+It will ensure that the Trusted Type <a data-link-type="dfn" href="#enforcement" id="ref-for-enforcement⑤">enforcement</a> rules were respected.</p>
    <p>Given a <code class="idl"><a data-link-type="idl" href="#typedefdef-trustedtype" id="ref-for-typedefdef-trustedtype①">TrustedType</a></code> type (<var>expectedType</var>), a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-realm-global" id="ref-for-concept-realm-global①">global object</a> (<var>global</var>), <code class="idl"><a data-link-type="idl" href="#typedefdef-trustedtype" id="ref-for-typedefdef-trustedtype②">TrustedType</a></code> or a string (<var>input</var>), a string (<var>sink</var>) and a string (<var>sinkGroup</var>), run these steps:</p>
    <ol>
     <li data-md>
      <p>Let <var>cspList</var> be the <var>global</var>’s <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#global-object-csp-list" id="ref-for-global-object-csp-list">CSP list</a>.</p>
     <li data-md>
      <p>If <var>cspList</var> is <code>null</code> or does not contain a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#content-security-policy-object" id="ref-for-content-security-policy-object">policy</a> which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#policy-directive-set" id="ref-for-policy-directive-set">directive set</a> containing a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#directives" id="ref-for-directives">directive</a> with a name <code>"require-trusted-types-for"</code>,
-or that directive does not contain a <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group③">trusted-types-sink-group</a> which is a match for a value <var>sinkGroup</var>,
+or that directive does not contain a <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group②">trusted-types-sink-group</a> which is a match for a value <var>sinkGroup</var>,
 return stringified <var>input</var> and abort these steps.</p>
     <li data-md>
      <p>If <var>input</var> has type <var>expectedType</var>, return stringified <var>input</var> and abort these steps.</p>
@@ -2383,11 +2377,11 @@ <h4 class="heading settled" data-level="4.9.1" id="require-trusted-types-for-csp
    <p><a data-link-type="dfn" href="#require-trusted-types-for-directive" id="ref-for-require-trusted-types-for-directive①">require-trusted-types-for</a> directive configures the Trusted
 Types framework for all the <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink②①">injection sinks</a> of certain groups in a current <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-global-object-realm" id="ref-for-concept-global-object-realm①">realm</a>.
 Specifically, it defines what should be the behavior when a string value is passed to an <a data-link-type="dfn" href="#injection-sink" id="ref-for-injection-sink②②">injection sink</a> of a given group (i.e. should the type-based enforcement be enabled for such sinks).</p>
-   <p class="note" role="note"><span class="marker">Note:</span> Currently, only the enforcement for <a href="#dom-xss-injection-sinks">§ 2.1.2 DOM XSS injection sinks</a> is specified.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> Currently, only the enforcement for <a href="#dom-xss-injection-sinks">§ 2.1.1 DOM XSS injection sinks</a> is specified.</p>
    <p>The syntax for the directive’s <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#directive-name" id="ref-for-directive-name">name</a> and <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#directive-value" id="ref-for-directive-value">value</a> is described by the following
 ABNF:</p>
 <pre>directive-name = "require-trusted-types-for"
-directive-value = <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group④">trusted-types-sink-group</a> *( <a href="https://w3c.github.io/webappsec-csp/#grammardef-required-ascii-whitespace">required-ascii-whitespace</a> <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group⑤">trusted-types-sink-group</a>)
+directive-value = <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group③">trusted-types-sink-group</a> *( <a href="https://w3c.github.io/webappsec-csp/#grammardef-required-ascii-whitespace">required-ascii-whitespace</a> <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group④">trusted-types-sink-group</a>)
 <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="trusted-types-sink-group">trusted-types-sink-group</dfn> = "'script'"
 </pre>
    <div class="example" id="require-tt-for-script-header">
@@ -2481,7 +2475,7 @@ <h4 class="heading settled" data-level="4.9.3" id="should-block-sink-type-mismat
        <p>Let <var>directive</var> be the <var>policy</var>’s <var>directive set</var>’s <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#directives" id="ref-for-directives⑤">directive</a> which name
 is <code>"require-trusted-types-for"</code></p>
       <li data-md>
-       <p>If <var>directive</var>’s <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#directive-value" id="ref-for-directive-value③">value</a> does not contain a <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group⑥">trusted-types-sink-group</a> which is a match
+       <p>If <var>directive</var>’s <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#directive-value" id="ref-for-directive-value③">value</a> does not contain a <a data-link-type="dfn" href="#trusted-types-sink-group" id="ref-for-trusted-types-sink-group⑤">trusted-types-sink-group</a> which is a match
 for a value <var>sinkGroup</var>, skip to the next <var>policy</var>.</p>
       <li data-md>
        <p>Let <var>violation</var> be the result of executing <a href="https://w3c.github.io/webappsec-csp/#create-violation-for-global">Create a violation object for global, policy, and directive</a> on <var>global</var>, <var>policy</var> and <code>"require-trusted-types-for"</code></p>
@@ -3880,9 +3874,9 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['b36452d7'] = {"dfnID": "b36452d7", "url": "https://w3c.github.io/webappsec-csp/#source-expression", "dfnText": "source expression", "refSections": [{"refs": [{"id": "ref-for-source-expression"}], "title": "4.9.6. Support for dynamic code compilation"}], "external": true};
 window.dfnpanelData['461b765a'] = {"dfnID": "461b765a", "url": "https://w3c.github.io/webappsec-csp/#directive-value", "dfnText": "value", "refSections": [{"refs": [{"id": "ref-for-directive-value"}], "title": "4.9.1. require-trusted-types-for directive"}, {"refs": [{"id": "ref-for-directive-value\u2460"}, {"id": "ref-for-directive-value\u2461"}], "title": "4.9.2. trusted-types directive"}, {"refs": [{"id": "ref-for-directive-value\u2462"}], "title": "4.9.3. Should sink type mismatch violation be blocked by Content Security Policy?"}, {"refs": [{"id": "ref-for-directive-value\u2463"}, {"id": "ref-for-directive-value\u2464"}, {"id": "ref-for-directive-value\u2465"}, {"id": "ref-for-directive-value\u2466"}], "title": "4.9.4. Should Trusted Type policy creation be blocked by Content Security Policy?"}, {"refs": [{"id": "ref-for-directive-value\u2467"}, {"id": "ref-for-directive-value\u2468"}], "title": "4.9.6. Support for dynamic code compilation"}], "external": true};
 window.dfnpanelData['32f77f83'] = {"dfnID": "32f77f83", "url": "https://w3c.github.io/webappsec-csp/#violation", "dfnText": "violation", "refSections": [{"refs": [{"id": "ref-for-violation"}], "title": "4.9.5. Violation object changes"}], "external": true};
-window.dfnpanelData['85394472'] = {"dfnID": "85394472", "url": "https://dom.spec.whatwg.org/#document", "dfnText": "Document", "refSections": [{"refs": [{"id": "ref-for-document"}], "title": "2.1.1. HTML injection sinks"}, {"refs": [{"id": "ref-for-document\u2460"}, {"id": "ref-for-document\u2461"}], "title": "3.7. Prepare the script URL and text"}, {"refs": [{"id": "ref-for-document\u2462"}, {"id": "ref-for-document\u2463"}], "title": "4.3.2. Extensions to the Document interface"}, {"refs": [{"id": "ref-for-document\u2464"}], "title": "4.5. Integration with SVG"}, {"refs": [{"id": "ref-for-document\u2465"}], "title": "4.7. Integration with DOM Parsing"}, {"refs": [{"id": "ref-for-document\u2466"}], "title": "4.8. Integration with execCommand"}], "external": true};
+window.dfnpanelData['85394472'] = {"dfnID": "85394472", "url": "https://dom.spec.whatwg.org/#document", "dfnText": "Document", "refSections": [{"refs": [{"id": "ref-for-document"}], "title": "2.1.1. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-document\u2460"}, {"id": "ref-for-document\u2461"}], "title": "3.7. Prepare the script URL and text"}, {"refs": [{"id": "ref-for-document\u2462"}, {"id": "ref-for-document\u2463"}], "title": "4.3.2. Extensions to the Document interface"}, {"refs": [{"id": "ref-for-document\u2464"}], "title": "4.5. Integration with SVG"}, {"refs": [{"id": "ref-for-document\u2465"}], "title": "4.7. Integration with DOM Parsing"}, {"refs": [{"id": "ref-for-document\u2466"}], "title": "4.8. Integration with execCommand"}], "external": true};
 window.dfnpanelData['49a2843d'] = {"dfnID": "49a2843d", "url": "https://dom.spec.whatwg.org/#documentfragment", "dfnText": "DocumentFragment", "refSections": [{"refs": [{"id": "ref-for-documentfragment"}], "title": "4.7. Integration with DOM Parsing"}], "external": true};
-window.dfnpanelData['296f3551'] = {"dfnID": "296f3551", "url": "https://dom.spec.whatwg.org/#element", "dfnText": "Element", "refSections": [{"refs": [{"id": "ref-for-element"}, {"id": "ref-for-element\u2460"}], "title": "2.1.2. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-element\u2461"}, {"id": "ref-for-element\u2462"}], "title": "2.3.1. TrustedTypePolicyFactory"}, {"refs": [{"id": "ref-for-element\u2463"}], "title": "4.6. Integration with DOM"}, {"refs": [{"id": "ref-for-element\u2464"}], "title": "4.7. Integration with DOM Parsing"}], "external": true};
+window.dfnpanelData['296f3551'] = {"dfnID": "296f3551", "url": "https://dom.spec.whatwg.org/#element", "dfnText": "Element", "refSections": [{"refs": [{"id": "ref-for-element"}, {"id": "ref-for-element\u2460"}], "title": "2.1.1. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-element\u2461"}, {"id": "ref-for-element\u2462"}], "title": "2.3.1. TrustedTypePolicyFactory"}, {"refs": [{"id": "ref-for-element\u2463"}], "title": "4.6. Integration with DOM"}, {"refs": [{"id": "ref-for-element\u2464"}], "title": "4.7. Integration with DOM Parsing"}], "external": true};
 window.dfnpanelData['2bc0cdf4'] = {"dfnID": "2bc0cdf4", "url": "https://dom.spec.whatwg.org/#eventtarget", "dfnText": "EventTarget", "refSections": [{"refs": [{"id": "ref-for-eventtarget"}, {"id": "ref-for-eventtarget\u2460"}, {"id": "ref-for-eventtarget\u2461"}], "title": "4.3.8. Web Workers"}, {"refs": [{"id": "ref-for-eventtarget\u2462"}], "title": "4.4. Integration with Service Workers"}], "external": true};
 window.dfnpanelData['d2bd0bce'] = {"dfnID": "d2bd0bce", "url": "https://dom.spec.whatwg.org/#range", "dfnText": "Range", "refSections": [{"refs": [{"id": "ref-for-range"}], "title": "4.7. Integration with DOM Parsing"}], "external": true};
 window.dfnpanelData['543878fa'] = {"dfnID": "543878fa", "url": "https://dom.spec.whatwg.org/#concept-node-append", "dfnText": "append", "refSections": [{"refs": [{"id": "ref-for-concept-node-append"}], "title": "4.6. Integration with DOM"}], "external": true};
@@ -3984,7 +3978,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['0c3aff42'] = {"dfnID": "0c3aff42", "url": "https://heycam.github.io/webidl/#this", "dfnText": "this", "refSections": [{"refs": [{"id": "ref-for-this"}, {"id": "ref-for-this\u2460"}], "title": "2.3.1. TrustedTypePolicyFactory"}, {"refs": [{"id": "ref-for-this\u2461"}, {"id": "ref-for-this\u2462"}, {"id": "ref-for-this\u2463"}], "title": "2.3.2. TrustedTypePolicy"}, {"refs": [{"id": "ref-for-this\u2464"}], "title": "4.2.2. Type conversion"}, {"refs": [{"id": "ref-for-this\u2465"}], "title": "4.3.1. Extensions to the WindowOrWorkerGlobalScope interface"}, {"refs": [{"id": "ref-for-this\u2466"}], "title": "4.3.5. Enforcement in timer functions"}], "external": true};
 window.dfnpanelData['5f90bbfb'] = {"dfnID": "5f90bbfb", "url": "https://webidl.spec.whatwg.org/#idl-undefined", "dfnText": "undefined", "refSections": [{"refs": [{"id": "ref-for-idl-undefined"}, {"id": "ref-for-idl-undefined\u2460"}], "title": "4.3.2. Extensions to the Document interface"}, {"refs": [{"id": "ref-for-idl-undefined\u2461"}], "title": "4.3.8. Web Workers"}, {"refs": [{"id": "ref-for-idl-undefined\u2462"}], "title": "4.7. Integration with DOM Parsing"}], "external": true};
 window.dfnpanelData['689ce6c5'] = {"dfnID": "689ce6c5", "url": "https://webidl.spec.whatwg.org/#dfn-variadic", "dfnText": "variadic", "refSections": [{"refs": [{"id": "ref-for-dfn-variadic"}], "title": "4.2. [StringContext]"}], "external": true};
-window.dfnpanelData['injection-sink'] = {"dfnID": "injection-sink", "url": "#injection-sink", "dfnText": "injection sink", "refSections": [{"refs": [{"id": "ref-for-injection-sink"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-injection-sink\u2460"}], "title": "1.3. Use cases"}, {"refs": [{"id": "ref-for-injection-sink\u2461"}], "title": "2.1. Injection sinks"}, {"refs": [{"id": "ref-for-injection-sink\u2462"}], "title": "2.1.1. HTML injection sinks"}, {"refs": [{"id": "ref-for-injection-sink\u2463"}], "title": "2.1.2. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-injection-sink\u2464"}], "title": "2.2. Trusted Types"}, {"refs": [{"id": "ref-for-injection-sink\u2465"}], "title": "2.2.1. TrustedHTML"}, {"refs": [{"id": "ref-for-injection-sink\u2466"}], "title": "2.2.2. TrustedScript"}, {"refs": [{"id": "ref-for-injection-sink\u2467"}], "title": "2.2.3. TrustedScriptURL"}, {"refs": [{"id": "ref-for-injection-sink\u2468"}, {"id": "ref-for-injection-sink\u2460\u24ea"}, {"id": "ref-for-injection-sink\u2460\u2460"}, {"id": "ref-for-injection-sink\u2460\u2461"}], "title": "2.3. Policies"}, {"refs": [{"id": "ref-for-injection-sink\u2460\u2462"}, {"id": "ref-for-injection-sink\u2460\u2463"}], "title": "2.3.4. Default policy"}, {"refs": [{"id": "ref-for-injection-sink\u2460\u2464"}, {"id": "ref-for-injection-sink\u2460\u2465"}, {"id": "ref-for-injection-sink\u2460\u2466"}], "title": "2.4. Enforcement"}, {"refs": [{"id": "ref-for-injection-sink\u2460\u2467"}], "title": "2.4.1. Content Security Policy"}, {"refs": [{"id": "ref-for-injection-sink\u2460\u2468"}], "title": "3.5. Get Trusted Type compliant string"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u24ea"}], "title": "3.6. Process value with a default policy"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2460"}, {"id": "ref-for-injection-sink\u2461\u2461"}], "title": "4.9.1. require-trusted-types-for directive"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2462"}, {"id": "ref-for-injection-sink\u2461\u2463"}], "title": "4.9.2. trusted-types directive"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2464"}], "title": "4.9.3. Should sink type mismatch violation be blocked by Content Security Policy?"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2465"}], "title": "5. Security Considerations"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2466"}, {"id": "ref-for-injection-sink\u2461\u2467"}], "title": "5.5. Best practices for policy design"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2468"}], "title": "6. Privacy Considerations"}, {"refs": [{"id": "ref-for-injection-sink\u2462\u24ea"}], "title": "7.1. Vendor-specific Extensions and Addons"}], "external": false};
+window.dfnpanelData['injection-sink'] = {"dfnID": "injection-sink", "url": "#injection-sink", "dfnText": "injection sink", "refSections": [{"refs": [{"id": "ref-for-injection-sink"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-injection-sink\u2460"}], "title": "1.3. Use cases"}, {"refs": [{"id": "ref-for-injection-sink\u2461"}], "title": "2.1. Injection sinks"}, {"refs": [{"id": "ref-for-injection-sink\u2462"}, {"id": "ref-for-injection-sink\u2463"}], "title": "2.1.1. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-injection-sink\u2464"}], "title": "2.2. Trusted Types"}, {"refs": [{"id": "ref-for-injection-sink\u2465"}], "title": "2.2.1. TrustedHTML"}, {"refs": [{"id": "ref-for-injection-sink\u2466"}], "title": "2.2.2. TrustedScript"}, {"refs": [{"id": "ref-for-injection-sink\u2467"}], "title": "2.2.3. TrustedScriptURL"}, {"refs": [{"id": "ref-for-injection-sink\u2468"}, {"id": "ref-for-injection-sink\u2460\u24ea"}, {"id": "ref-for-injection-sink\u2460\u2460"}, {"id": "ref-for-injection-sink\u2460\u2461"}], "title": "2.3. Policies"}, {"refs": [{"id": "ref-for-injection-sink\u2460\u2462"}, {"id": "ref-for-injection-sink\u2460\u2463"}], "title": "2.3.4. Default policy"}, {"refs": [{"id": "ref-for-injection-sink\u2460\u2464"}, {"id": "ref-for-injection-sink\u2460\u2465"}, {"id": "ref-for-injection-sink\u2460\u2466"}], "title": "2.4. Enforcement"}, {"refs": [{"id": "ref-for-injection-sink\u2460\u2467"}], "title": "2.4.1. Content Security Policy"}, {"refs": [{"id": "ref-for-injection-sink\u2460\u2468"}], "title": "3.5. Get Trusted Type compliant string"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u24ea"}], "title": "3.6. Process value with a default policy"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2460"}, {"id": "ref-for-injection-sink\u2461\u2461"}], "title": "4.9.1. require-trusted-types-for directive"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2462"}, {"id": "ref-for-injection-sink\u2461\u2463"}], "title": "4.9.2. trusted-types directive"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2464"}], "title": "4.9.3. Should sink type mismatch violation be blocked by Content Security Policy?"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2465"}], "title": "5. Security Considerations"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2466"}, {"id": "ref-for-injection-sink\u2461\u2467"}], "title": "5.5. Best practices for policy design"}, {"refs": [{"id": "ref-for-injection-sink\u2461\u2468"}], "title": "6. Privacy Considerations"}, {"refs": [{"id": "ref-for-injection-sink\u2462\u24ea"}], "title": "7.1. Vendor-specific Extensions and Addons"}], "external": false};
 window.dfnpanelData['trusted-type'] = {"dfnID": "trusted-type", "url": "#trusted-type", "dfnText": "Trusted Type", "refSections": [{"refs": [{"id": "ref-for-trusted-type"}], "title": "2.3. Policies"}, {"refs": [{"id": "ref-for-trusted-type\u2460"}], "title": "2.3.1. TrustedTypePolicyFactory"}, {"refs": [{"id": "ref-for-trusted-type\u2461"}], "title": "2.3.3. TrustedTypePolicyOptions"}, {"refs": [{"id": "ref-for-trusted-type\u2462"}], "title": "2.4. Enforcement"}, {"refs": [{"id": "ref-for-trusted-type\u2463"}], "title": "3.5. Get Trusted Type compliant string"}, {"refs": [{"id": "ref-for-trusted-type\u2464"}], "title": "4.9.3. Should sink type mismatch violation be blocked by Content Security Policy?"}], "external": false};
 window.dfnpanelData['trustedhtml'] = {"dfnID": "trustedhtml", "url": "#trustedhtml", "dfnText": "TrustedHTML", "refSections": [{"refs": [{"id": "ref-for-trustedhtml"}, {"id": "ref-for-trustedhtml\u2460"}, {"id": "ref-for-trustedhtml\u2461"}], "title": "2.2.1. TrustedHTML"}, {"refs": [{"id": "ref-for-trustedhtml\u2462"}], "title": "2.3. Policies"}, {"refs": [{"id": "ref-for-trustedhtml\u2463"}, {"id": "ref-for-trustedhtml\u2464"}, {"id": "ref-for-trustedhtml\u2465"}, {"id": "ref-for-trustedhtml\u2466"}], "title": "2.3.1. TrustedTypePolicyFactory"}, {"refs": [{"id": "ref-for-trustedhtml\u2467"}], "title": "2.3.2. TrustedTypePolicy"}, {"refs": [{"id": "ref-for-trustedhtml\u2468"}], "title": "3.3. Create a Trusted Type from literal"}, {"refs": [{"id": "ref-for-trustedhtml\u2460\u24ea"}, {"id": "ref-for-trustedhtml\u2460\u2460"}], "title": "4. Integrations"}, {"refs": [{"id": "ref-for-trustedhtml\u2460\u2461"}], "title": "4.2. [StringContext]"}, {"refs": [{"id": "ref-for-trustedhtml\u2460\u2462"}], "title": "4.8. Integration with execCommand"}], "external": false};
 window.dfnpanelData['dom-trustedhtml-tojson'] = {"dfnID": "dom-trustedhtml-tojson", "url": "#dom-trustedhtml-tojson", "dfnText": "toJSON()", "refSections": [{"refs": [{"id": "ref-for-dom-trustedhtml-tojson"}], "title": "2.2.1. TrustedHTML"}], "external": false};
@@ -4022,7 +4016,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['callbackdef-createscriptcallback'] = {"dfnID": "callbackdef-createscriptcallback", "url": "#callbackdef-createscriptcallback", "dfnText": "CreateScriptCallback", "refSections": [{"refs": [{"id": "ref-for-callbackdef-createscriptcallback"}], "title": "2.3.3. TrustedTypePolicyOptions"}], "external": false};
 window.dfnpanelData['callbackdef-createscripturlcallback'] = {"dfnID": "callbackdef-createscripturlcallback", "url": "#callbackdef-createscripturlcallback", "dfnText": "CreateScriptURLCallback", "refSections": [{"refs": [{"id": "ref-for-callbackdef-createscripturlcallback"}], "title": "2.3.3. TrustedTypePolicyOptions"}], "external": false};
 window.dfnpanelData['default-policy'] = {"dfnID": "default-policy", "url": "#default-policy", "dfnText": "Default policy", "refSections": [{"refs": [{"id": "ref-for-default-policy"}], "title": "4.9.1.1. require-trusted-types-for Pre-Navigation check"}, {"refs": [{"id": "ref-for-default-policy\u2460"}], "title": "4.9.2. trusted-types directive"}, {"refs": [{"id": "ref-for-default-policy\u2461"}], "title": "4.9.6. Support for dynamic code compilation"}, {"refs": [{"id": "ref-for-default-policy\u2462"}], "title": "6. Privacy Considerations"}, {"refs": [{"id": "ref-for-default-policy\u2463"}], "title": "7.1. Vendor-specific Extensions and Addons"}], "external": false};
-window.dfnpanelData['enforcement'] = {"dfnID": "enforcement", "url": "#enforcement", "dfnText": "Enforcement", "refSections": [{"refs": [{"id": "ref-for-enforcement"}], "title": "1.3. Use cases"}, {"refs": [{"id": "ref-for-enforcement\u2460"}], "title": "2.1. Injection sinks"}, {"refs": [{"id": "ref-for-enforcement\u2461"}], "title": "2.1.1. HTML injection sinks"}, {"refs": [{"id": "ref-for-enforcement\u2462"}, {"id": "ref-for-enforcement\u2463"}], "title": "2.3. Policies"}, {"refs": [{"id": "ref-for-enforcement\u2464"}], "title": "2.3.4. Default policy"}, {"refs": [{"id": "ref-for-enforcement\u2465"}], "title": "3.5. Get Trusted Type compliant string"}], "external": false};
+window.dfnpanelData['enforcement'] = {"dfnID": "enforcement", "url": "#enforcement", "dfnText": "Enforcement", "refSections": [{"refs": [{"id": "ref-for-enforcement"}], "title": "1.3. Use cases"}, {"refs": [{"id": "ref-for-enforcement\u2460"}], "title": "2.1. Injection sinks"}, {"refs": [{"id": "ref-for-enforcement\u2461"}, {"id": "ref-for-enforcement\u2462"}], "title": "2.3. Policies"}, {"refs": [{"id": "ref-for-enforcement\u2463"}], "title": "2.3.4. Default policy"}, {"refs": [{"id": "ref-for-enforcement\u2464"}], "title": "3.5. Get Trusted Type compliant string"}], "external": false};
 window.dfnpanelData['abstract-opdef-create-a-trusted-type-policy'] = {"dfnID": "abstract-opdef-create-a-trusted-type-policy", "url": "#abstract-opdef-create-a-trusted-type-policy", "dfnText": "Create a Trusted Type Policy", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-create-a-trusted-type-policy"}], "title": "2.3.1. TrustedTypePolicyFactory"}], "external": false};
 window.dfnpanelData['abstract-opdef-create-a-trusted-type'] = {"dfnID": "abstract-opdef-create-a-trusted-type", "url": "#abstract-opdef-create-a-trusted-type", "dfnText": "Create a Trusted Type", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-create-a-trusted-type"}, {"id": "ref-for-abstract-opdef-create-a-trusted-type\u2460"}, {"id": "ref-for-abstract-opdef-create-a-trusted-type\u2461"}], "title": "2.3.2. TrustedTypePolicy"}, {"refs": [{"id": "ref-for-abstract-opdef-create-a-trusted-type\u2462"}], "title": "3.6. Process value with a default policy"}], "external": false};
 window.dfnpanelData['abstract-opdef-create-a-trusted-type-from-literal'] = {"dfnID": "abstract-opdef-create-a-trusted-type-from-literal", "url": "#abstract-opdef-create-a-trusted-type-from-literal", "dfnText": "Create a Trusted Type from literal", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-create-a-trusted-type-from-literal"}], "title": "2.2.1. TrustedHTML"}, {"refs": [{"id": "ref-for-abstract-opdef-create-a-trusted-type-from-literal\u2460"}], "title": "2.2.2. TrustedScript"}, {"refs": [{"id": "ref-for-abstract-opdef-create-a-trusted-type-from-literal\u2461"}], "title": "2.2.3. TrustedScriptURL"}], "external": false};
@@ -4039,21 +4033,21 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['dfn-validate-the-string-in-context'] = {"dfnID": "dfn-validate-the-string-in-context", "url": "#dfn-validate-the-string-in-context", "dfnText": "validate the string in context", "refSections": [{"refs": [{"id": "ref-for-dfn-validate-the-string-in-context"}], "title": "4.2.2. Type conversion"}, {"refs": [{"id": "ref-for-dfn-validate-the-string-in-context\u2460"}, {"id": "ref-for-dfn-validate-the-string-in-context\u2461"}], "title": "4.3.7. Validate the string in context"}], "external": false};
 window.dfnpanelData['window-trusted-type-policy-factory'] = {"dfnID": "window-trusted-type-policy-factory", "url": "#window-trusted-type-policy-factory", "dfnText": "trusted type policy factory", "refSections": [{"refs": [{"id": "ref-for-window-trusted-type-policy-factory"}], "title": "3.6. Process value with a default policy"}, {"refs": [{"id": "ref-for-window-trusted-type-policy-factory\u2460"}], "title": "4.3.7. Validate the string in context"}], "external": false};
 window.dfnpanelData['dom-windoworworkerglobalscope-trustedtypes'] = {"dfnID": "dom-windoworworkerglobalscope-trustedtypes", "url": "#dom-windoworworkerglobalscope-trustedtypes", "dfnText": "trustedTypes", "refSections": [{"refs": [{"id": "ref-for-dom-windoworworkerglobalscope-trustedtypes"}], "title": "2.4. Enforcement"}, {"refs": [{"id": "ref-for-dom-windoworworkerglobalscope-trustedtypes\u2460"}], "title": "4.3.1. Extensions to the WindowOrWorkerGlobalScope interface"}], "external": false};
-window.dfnpanelData['dom-document-write'] = {"dfnID": "dom-document-write", "url": "#dom-document-write", "dfnText": "write", "refSections": [{"refs": [{"id": "ref-for-dom-document-write"}], "title": "2.1.1. HTML injection sinks"}], "external": false};
+window.dfnpanelData['dom-document-write'] = {"dfnID": "dom-document-write", "url": "#dom-document-write", "dfnText": "write", "refSections": [{"refs": [{"id": "ref-for-dom-document-write"}], "title": "2.1.1. DOM XSS injection sinks"}], "external": false};
 window.dfnpanelData['dom-htmlscriptelement-scripturl-slot'] = {"dfnID": "dom-htmlscriptelement-scripturl-slot", "url": "#dom-htmlscriptelement-scripturl-slot", "dfnText": "[[ScriptURL]]", "refSections": [{"refs": [{"id": "ref-for-dom-htmlscriptelement-scripturl-slot"}, {"id": "ref-for-dom-htmlscriptelement-scripturl-slot\u2460"}, {"id": "ref-for-dom-htmlscriptelement-scripturl-slot\u2461"}], "title": "3.7. Prepare the script URL and text"}, {"refs": [{"id": "ref-for-dom-htmlscriptelement-scripturl-slot\u2462"}], "title": "4.3.3.1. Slots with trusted values"}, {"refs": [{"id": "ref-for-dom-htmlscriptelement-scripturl-slot\u2463"}], "title": "4.3.3.2. Setting slot values"}], "external": false};
 window.dfnpanelData['dom-htmlscriptelement-scripttext-slot'] = {"dfnID": "dom-htmlscriptelement-scripttext-slot", "url": "#dom-htmlscriptelement-scripttext-slot", "dfnText": "[[ScriptText]]", "refSections": [{"refs": [{"id": "ref-for-dom-htmlscriptelement-scripttext-slot"}, {"id": "ref-for-dom-htmlscriptelement-scripttext-slot\u2460"}], "title": "3.7. Prepare the script URL and text"}, {"refs": [{"id": "ref-for-dom-htmlscriptelement-scripttext-slot\u2461"}], "title": "4.3.3.2. Setting slot values"}], "external": false};
-window.dfnpanelData['dom-htmlscriptelement-src'] = {"dfnID": "dom-htmlscriptelement-src", "url": "#dom-htmlscriptelement-src", "dfnText": "src", "refSections": [{"refs": [{"id": "ref-for-dom-htmlscriptelement-src"}], "title": "2.1.2. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-dom-htmlscriptelement-src\u2460"}], "title": "4.3.3.1. Slots with trusted values"}, {"refs": [{"id": "ref-for-dom-htmlscriptelement-src\u2461"}], "title": "4.3.3.2. Setting slot values"}], "external": false};
-window.dfnpanelData['dom-htmlscriptelement-text'] = {"dfnID": "dom-htmlscriptelement-text", "url": "#dom-htmlscriptelement-text", "dfnText": "text", "refSections": [{"refs": [{"id": "ref-for-dom-htmlscriptelement-text"}], "title": "2.1.2. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-dom-htmlscriptelement-text\u2460"}], "title": "4.3.3.2. Setting slot values"}], "external": false};
+window.dfnpanelData['dom-htmlscriptelement-src'] = {"dfnID": "dom-htmlscriptelement-src", "url": "#dom-htmlscriptelement-src", "dfnText": "src", "refSections": [{"refs": [{"id": "ref-for-dom-htmlscriptelement-src"}], "title": "2.1.1. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-dom-htmlscriptelement-src\u2460"}], "title": "4.3.3.1. Slots with trusted values"}, {"refs": [{"id": "ref-for-dom-htmlscriptelement-src\u2461"}], "title": "4.3.3.2. Setting slot values"}], "external": false};
+window.dfnpanelData['dom-htmlscriptelement-text'] = {"dfnID": "dom-htmlscriptelement-text", "url": "#dom-htmlscriptelement-text", "dfnText": "text", "refSections": [{"refs": [{"id": "ref-for-dom-htmlscriptelement-text"}], "title": "2.1.1. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-dom-htmlscriptelement-text\u2460"}], "title": "4.3.3.2. Setting slot values"}], "external": false};
 window.dfnpanelData['typedefdef-trustedtimerhandler'] = {"dfnID": "typedefdef-trustedtimerhandler", "url": "#typedefdef-trustedtimerhandler", "dfnText": "TrustedTimerHandler", "refSections": [{"refs": [{"id": "ref-for-typedefdef-trustedtimerhandler"}, {"id": "ref-for-typedefdef-trustedtimerhandler\u2460"}], "title": "4.3.5. Enforcement in timer functions"}], "external": false};
 window.dfnpanelData['dom-workerglobalscope-importscripts'] = {"dfnID": "dom-workerglobalscope-importscripts", "url": "#dom-workerglobalscope-importscripts", "dfnText": "importScripts", "refSections": [{"refs": [{"id": "ref-for-dom-workerglobalscope-importscripts"}], "title": "4.3.8. Web Workers"}], "external": false};
 window.dfnpanelData['dom-svganimatedstring-baseval'] = {"dfnID": "dom-svganimatedstring-baseval", "url": "#dom-svganimatedstring-baseval", "dfnText": "baseVal", "refSections": [{"refs": [{"id": "ref-for-dom-svganimatedstring-baseval"}], "title": "4.5. Integration with SVG"}], "external": false};
 window.dfnpanelData['concept-element-attributes-validation-ext'] = {"dfnID": "concept-element-attributes-validation-ext", "url": "#concept-element-attributes-validation-ext", "dfnText": "attribute validation steps", "refSections": [{"refs": [{"id": "ref-for-concept-element-attributes-validation-ext"}, {"id": "ref-for-concept-element-attributes-validation-ext\u2460"}], "title": "4.6. Integration with DOM"}], "external": false};
-window.dfnpanelData['dom-element-outerhtml'] = {"dfnID": "dom-element-outerhtml", "url": "#dom-element-outerhtml", "dfnText": "outerHTML", "refSections": [{"refs": [{"id": "ref-for-dom-element-outerhtml"}], "title": "2.1.1. HTML injection sinks"}], "external": false};
-window.dfnpanelData['dom-innerhtml-innerhtml'] = {"dfnID": "dom-innerhtml-innerhtml", "url": "#dom-innerhtml-innerhtml", "dfnText": "innerHTML", "refSections": [{"refs": [{"id": "ref-for-dom-innerhtml-innerhtml"}], "title": "2.1.1. HTML injection sinks"}], "external": false};
+window.dfnpanelData['dom-element-outerhtml'] = {"dfnID": "dom-element-outerhtml", "url": "#dom-element-outerhtml", "dfnText": "outerHTML", "refSections": [{"refs": [{"id": "ref-for-dom-element-outerhtml"}], "title": "2.1.1. DOM XSS injection sinks"}], "external": false};
+window.dfnpanelData['dom-innerhtml-innerhtml'] = {"dfnID": "dom-innerhtml-innerhtml", "url": "#dom-innerhtml-innerhtml", "dfnText": "innerHTML", "refSections": [{"refs": [{"id": "ref-for-dom-innerhtml-innerhtml"}], "title": "2.1.1. DOM XSS injection sinks"}], "external": false};
 window.dfnpanelData['dom-range-createcontextualfragment'] = {"dfnID": "dom-range-createcontextualfragment", "url": "#dom-range-createcontextualfragment", "dfnText": "createContextualFragment", "refSections": [{"refs": [{"id": "ref-for-dom-range-createcontextualfragment"}], "title": "4.8. Integration with execCommand"}], "external": false};
-window.dfnpanelData['dom-domparser-parsefromstring'] = {"dfnID": "dom-domparser-parsefromstring", "url": "#dom-domparser-parsefromstring", "dfnText": "parseFromString", "refSections": [{"refs": [{"id": "ref-for-dom-domparser-parsefromstring"}], "title": "2.1.1. HTML injection sinks"}], "external": false};
+window.dfnpanelData['dom-domparser-parsefromstring'] = {"dfnID": "dom-domparser-parsefromstring", "url": "#dom-domparser-parsefromstring", "dfnText": "parseFromString", "refSections": [{"refs": [{"id": "ref-for-dom-domparser-parsefromstring"}], "title": "2.1.1. DOM XSS injection sinks"}], "external": false};
 window.dfnpanelData['require-trusted-types-for-directive'] = {"dfnID": "require-trusted-types-for-directive", "url": "#require-trusted-types-for-directive", "dfnText": "require-trusted-types-for", "refSections": [{"refs": [{"id": "ref-for-require-trusted-types-for-directive"}], "title": "2.4.1. Content Security Policy"}, {"refs": [{"id": "ref-for-require-trusted-types-for-directive\u2460"}], "title": "4.9.1. require-trusted-types-for directive"}, {"refs": [{"id": "ref-for-require-trusted-types-for-directive\u2461"}, {"id": "ref-for-require-trusted-types-for-directive\u2462"}], "title": "4.9.1.1. require-trusted-types-for Pre-Navigation check"}], "external": false};
-window.dfnpanelData['trusted-types-sink-group'] = {"dfnID": "trusted-types-sink-group", "url": "#trusted-types-sink-group", "dfnText": "trusted-types-sink-group", "refSections": [{"refs": [{"id": "ref-for-trusted-types-sink-group"}], "title": "2.1. Injection sinks"}, {"refs": [{"id": "ref-for-trusted-types-sink-group\u2460"}], "title": "2.1.1. HTML injection sinks"}, {"refs": [{"id": "ref-for-trusted-types-sink-group\u2461"}], "title": "2.1.2. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-trusted-types-sink-group\u2462"}], "title": "3.5. Get Trusted Type compliant string"}, {"refs": [{"id": "ref-for-trusted-types-sink-group\u2463"}, {"id": "ref-for-trusted-types-sink-group\u2464"}], "title": "4.9.1. require-trusted-types-for directive"}, {"refs": [{"id": "ref-for-trusted-types-sink-group\u2465"}], "title": "4.9.3. Should sink type mismatch violation be blocked by Content Security Policy?"}], "external": false};
+window.dfnpanelData['trusted-types-sink-group'] = {"dfnID": "trusted-types-sink-group", "url": "#trusted-types-sink-group", "dfnText": "trusted-types-sink-group", "refSections": [{"refs": [{"id": "ref-for-trusted-types-sink-group"}], "title": "2.1. Injection sinks"}, {"refs": [{"id": "ref-for-trusted-types-sink-group\u2460"}], "title": "2.1.1. DOM XSS injection sinks"}, {"refs": [{"id": "ref-for-trusted-types-sink-group\u2461"}], "title": "3.5. Get Trusted Type compliant string"}, {"refs": [{"id": "ref-for-trusted-types-sink-group\u2462"}, {"id": "ref-for-trusted-types-sink-group\u2463"}], "title": "4.9.1. require-trusted-types-for directive"}, {"refs": [{"id": "ref-for-trusted-types-sink-group\u2464"}], "title": "4.9.3. Should sink type mismatch violation be blocked by Content Security Policy?"}], "external": false};
 window.dfnpanelData['trusted-types-directive'] = {"dfnID": "trusted-types-directive", "url": "#trusted-types-directive", "dfnText": "trusted-types", "refSections": [{"refs": [{"id": "ref-for-trusted-types-directive"}], "title": "2.3.1. TrustedTypePolicyFactory"}, {"refs": [{"id": "ref-for-trusted-types-directive\u2460"}], "title": "4.9.2. trusted-types directive"}], "external": false};
 window.dfnpanelData['serialized-tt-configuration'] = {"dfnID": "serialized-tt-configuration", "url": "#serialized-tt-configuration", "dfnText": "serialized-tt-configuration", "refSections": [{"refs": [{"id": "ref-for-serialized-tt-configuration"}], "title": "4.9.2. trusted-types directive"}], "external": false};
 window.dfnpanelData['tt-expression'] = {"dfnID": "tt-expression", "url": "#tt-expression", "dfnText": "tt-expression", "refSections": [{"refs": [{"id": "ref-for-tt-expression"}, {"id": "ref-for-tt-expression\u2460"}], "title": "4.9.2. trusted-types directive"}], "external": false};