Reflect.isTemplateObject (stage2)

Use cases & Prior Discussions

Distinguishing strings from a trusted developer from strings that may be attacker controlled

result=sensitiveOperation`trusted0${untrusted} trusted1`// Authored by dev          ^^^^^^^^                ^^^^^^^^// May come from outside                ^^^^^^^^^

function(trustedStrings, ...untrustedArguments){if(Reflect.isTemplateObject(trustedStrings)// instanceof provides a same-Realm guarantee for early frozen objects.&&trustedStringsinstanceofArray){// Proceed knowing that trustedStrings come from// the JavaScript module's authors.}else{// Do not trust trustedStrings}}

constattackerControlledString='((x) => x)`evil string`';// Naive codeletx=eval(attackerControlledString)console.log(Reflect.isTemplateObject(x));

An Example

const{ Array, Reflect, TypeError}=globalThis;const{ createPolicy}=trustedTypes;const{ isTemplateObject}=Reflect;const{error:consoleErr}=console;/** * A tag function that produces *TrustedHTML* or null if the * policy name "trustedHTMLTagFunction" is not available. */exporttrustedHTML=(()=>{// We use TrustedType's first-come-first-serve policy name restrictions// to provision this scope with sensitiveOperation.constpolicyName='trustedHTMLTagFunction';letpolicy;try{policy=createPolicy('trustedHTMLTagFunction',{createHTML(s){returns}});}catch(ex){consoleErr(`${policyName} is not an allowed trustedTypes policy name`);returnnull;}// This is the sensitive operation.const{ createHTML}=policy;// This tag function uses isTemplateObject to reject strings that// do not appear in user code in the same realm.//// With a reliable isTemplateObject check, the attack surface is// <= |set of template applications in trusted code|.//// That set is finite.//// Without a reliable isTemplateObject check, the attack surface is// <= |set of attacker controlled strings|.  That is, in practice,// unbounded.//// This assumes no attacker has eval.consttrustedHTMLTagFunction=(strings)=>{if(isTemplateObject(strings)&&stringsinstanceofArray){returncreateHTML(strings.raw[0]);}thrownewTypeError("Expected template object");};// With the check it's safe to export this tag function that closes// over a sensitive operation to anyone.returntrustedHTMLTagFunction;})()

// A naive, but non-malicious function.functionf(x){// People trust trustedHTMLTagFunction.// Our HTML is trustworthy because <bad argument> so we'll just// piggyback off that by using a value that looks like a template object.// What could possibly go wrong?consts=dodgyMarkdownToHTMLConverter(x);constpseudoTemplateObject=[s];pseudoTemplateObject.raw=Object.freeze([s]);returntrustedHTML(Object.freeze(pseudoTemplateObject));}// An attacker controlled string reaches f().constpayload='<img onerror=alert(document.origin) src=x>';console.log(`f(${JSON.stringify(payload)}) =${f(payload)}`);

What this is not

Possible Spec Language

Tests

Related Work