From df75faff495652d1a2d71510519bf308347dcead Mon Sep 17 00:00:00 2001
From: Noam Rosenthal <nrosenthal@chromium.org>
Date: Thu, 16 Jul 2026 03:55:54 -0700
Subject: [PATCH] TrustedParserOptions: return a new sanitizer in each call

This is instead of retaining a frozen copy.
See https://github.com/w3c/trusted-types/pull/606

Bug: 491743369
Change-Id: Ida4d1a661edb8475cbc4a1b2ce0d0e3d38913024
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8097523
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Noam Rosenthal <nrosenthal@google.com>
Cr-Commit-Position: refs/heads/main@{#1663095}
---
 ...am-html-with-trusted-types-pass-trusted.html | 17 ++++-------------
 ...l-with-trustedtypes-immutable.tentative.html | 17 +++++++++--------
 2 files changed, 13 insertions(+), 21 deletions(-)

diff --git a/domparsing/tentative/stream-html-with-trusted-types-pass-trusted.html b/domparsing/tentative/stream-html-with-trusted-types-pass-trusted.html
index 2f5cbe7bc7b5a2..dda5b1dfbd7744 100644
--- a/domparsing/tentative/stream-html-with-trusted-types-pass-trusted.html
+++ b/domparsing/tentative/stream-html-with-trusted-types-pass-trusted.html
@@ -33,20 +33,14 @@
       }
 
       const methods = [
-        "streamHTML",
         "streamHTMLUnsafe",
-        "streamAppendHTML",
         "streamAppendHTMLUnsafe",
-        "streamPrependHTML",
         "streamPrependHTMLUnsafe",
-        "streamBeforeHTML",
         "streamBeforeHTMLUnsafe",
-        "streamAfterHTML",
         "streamAfterHTMLUnsafe",
       ];
 
       for (const method of methods) {
-        const safe = !method.endsWith("Unsafe");
         promise_test(
           async (t) => {
             t.add_cleanup(cleanup);
@@ -67,13 +61,10 @@
             window.did_run = false;
             await writer.write("<script>window.did_run = true;<" + "/script>");
             await writer.close();
-            assert_equals(
-              container.querySelectorAll("script").length,
-              safe ? 0 : 1,
-            );
-            assert_equals(window.did_run, !safe);
+            assert_equals(container.querySelectorAll("script").length, 1);
+            assert_equals(window.did_run, true);
           },
-          `A given TrustedParserOptions can${safe ? " not" : ""} override default policy's runScript/safety for ${method}`,
+          `A given TrustedParserOptions can override default policy's runScript/safety for ${method}`,
         );
       }
 
@@ -94,7 +85,7 @@
           const writer = d[method](trusted_options).getWriter();
           window.did_run = false;
           await writer.write(
-            "<div id=allowed><span id=forbidden></span<</div>",
+            "<div id=allowed><span id=forbidden></span></div>",
           );
           await writer.close();
           assert_equals(
diff --git a/sanitizer-api/sethtml-with-trustedtypes-immutable.tentative.html b/sanitizer-api/sethtml-with-trustedtypes-immutable.tentative.html
index 4153d5f534fb53..e6d53c5853f929 100644
--- a/sanitizer-api/sethtml-with-trustedtypes-immutable.tentative.html
+++ b/sanitizer-api/sethtml-with-trustedtypes-immutable.tentative.html
@@ -91,11 +91,12 @@
         assert_true(callback_sanitizer instanceof Sanitizer, "callback should receive a Sanitizer object");
 
         // 2. Check that the returned TrustedParserOptions contains a Sanitizer object.
-        assert_true(options.sanitizer instanceof Sanitizer, "TrustedParserOptions.sanitizer should return a Sanitizer");
+        assert_true(options.sanitizer() instanceof Sanitizer, "TrustedParserOptions.sanitizer() should return a Sanitizer");
+        assert_not_equals(options.sanitizer(), options.sanitizer(), "calling sanitizer() twice should return different objects");
 
-        // 3. Mutating the Sanitizer returned by the getter does not affect sanitizing.
+        // 3. Mutating the Sanitizer returned by the method does not affect sanitizing.
         // The config had removeElements: ["span"]. Let's try to mutate the returned sanitizer to also remove "div".
-        options.sanitizer.removeElement("div");
+        options.sanitizer().removeElement("div");
 
         const d = document.createElement("div");
         document.querySelector("#container").appendChild(d);
@@ -103,7 +104,7 @@
 
         d.setHTMLUnsafe("<div>Allowed<span>Forbidden</span></div>", options);
 
-        // "div" should NOT be removed (because mutation on options.sanitizer has no effect on the clone used for parsing).
+        // "div" should NOT be removed (because mutation on options.sanitizer() has no effect on the clone used for parsing).
         assert_not_equals(d.querySelector("div"), null, "div should not be removed by mutated sanitizer");
         // "span" should still be removed (because the original config specified removeElements: ["span"]).
         assert_equals(d.querySelector("span"), null, "span should be removed by original sanitizer configuration");
@@ -123,9 +124,9 @@
         const options = policy.createParserOptions({ sanitizer: s });
         assert_true(callback_sanitizer instanceof Sanitizer, "callback should receive a Sanitizer object");
         assert_not_equals(callback_sanitizer, s, "callback sanitizer should be a clone, not the original");
-        assert_true(options.sanitizer instanceof Sanitizer, "TrustedParserOptions.sanitizer should return a Sanitizer");
-        assert_not_equals(options.sanitizer, s, "getter sanitizer should be a clone, not the original");
-        assert_equals(options.sanitizer, options.sanitizer, "SameObject: getter should return the same object reference");
+        assert_true(options.sanitizer() instanceof Sanitizer, "TrustedParserOptions.sanitizer() should return a Sanitizer");
+        assert_not_equals(options.sanitizer(), s, "method sanitizer() should return a clone, not the original");
+        assert_not_equals(options.sanitizer(), options.sanitizer(), "method sanitizer() should return different object references in every call");
       }, "TrustedParserOptions sanitizer clone testing with Sanitizer object input");
 
       test((t) => {
@@ -140,7 +141,7 @@
 
         const options = policy.createParserOptions({ sanitizer: "default" });
         assert_true(callback_sanitizer instanceof Sanitizer, "callback should receive a Sanitizer object when preset is passed");
-        assert_true(options.sanitizer instanceof Sanitizer, "TrustedParserOptions.sanitizer should return a Sanitizer when preset is passed");
+        assert_true(options.sanitizer() instanceof Sanitizer, "TrustedParserOptions.sanitizer() should return a Sanitizer when preset is passed");
       }, "TrustedParserOptions sanitizer clone testing with Preset string input");
     </script>
   </body>