Trusted Types: Element.setAttribute() and setAttributeNS()

[hamishwillee]

The value argument for Element.setAttribute() and Element.setAttributeNS() can be a source for XSS-attacks for some properties.

This updates the docs for trusted types. Most of the update is in setAttribute() which has the header and a security considerations section. It also adds an example for trusted types. The setAttributeNS() version has the same header but that links to the Non-NS version of security considerations. I also linked in the example section to the other method's TT example.

Related docs work can be tracked in #41507

[github-actions]

Preview URLs

• /en-US/docs/Web/API/Element/setAttributeNS
• /en-US/docs/Web/API/Element/setAttribute

Flaws (1)

Note! 1 document with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Web/API/Element/setAttributeNS
Title: Element: setAttributeNS() method
Flaw count: 1

• unknown:
  • must be provided

External URLs (2)

URL: /en-US/docs/Web/API/Element/setAttribute
Title: Element: setAttribute() method

• https://github.com/cure53/DOMPurify (1 time) (Note! This may be a new URL 👀)
• https://www.w3.org/TR/xml/ (1 time) (Note! This may be a new URL 👀)

[hamishwillee]

This is a "non-trusted-types" update to improve the example. The old version updated the name and disabled attributes of a button, and displayed the button - you then had to inspect the button to see that the name attribute had changed.

I updated this to display the name attribute on the button so you don't have to inspect to see the name changed. Further, I added a toggle button so that you can see how you change the disabled property. This made it more clear to me that you can't set the disabled attribute to remove it - you must call removeAttribute. That was not obvious to me.