From aa0f4e89a9c34273ba2a4b70169cc50b247cb8da Mon Sep 17 00:00:00 2001
From: Noam Rosenthal <noamr@users.noreply.github.com>
Date: Mon, 1 Apr 2024 04:39:36 +0000
Subject: [PATCH] Preload: only allow certain values for as=""

Closes #8332.
---
 source | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/source b/source
index eca9f85cdb9..0de2e1efe08 100644
--- a/source
+++ b/source
@@ -15721,8 +15721,8 @@ interface <dfn interface>HTMLLinkElement</dfn> : <span>HTMLElement</span> {
    <li><p><span>Assert</span>: <var>options</var>'s <span data-x="link options href">href</span> is
    not the empty string.</p></li>
 
-   <li><p>If <var>options</var>'s <span data-x="link options destination">destination</span> is not
-   a <span data-x="concept-request-destination">destination</span>, then return null.</p></li>
+   <li><p>If <var>options</var>'s <span data-x="link options destination">destination</span> is
+   null, then return null.</p></li>
 
    <li>
     <p>Let <var>url</var> be the result of <span>encoding-parsing a URL</span> given
@@ -15861,8 +15861,9 @@ interface <dfn interface>HTMLLinkElement</dfn> : <span>HTMLElement</span> {
 
     <dl class="props">
      <dt><span data-x="link options destination">destination</span></dt>
-     <dd>the result of <span data-x="concept-potential-destination-translate">translating</span> the
-     state of <var>el</var>'s <code data-x="attr-link-as">as</code> attribute</dd>
+     <dd>the result of <span
+     data-x="translate a preload destination">translating</span> the state of <var>el</var>'s <code
+     data-x="attr-link-as">as</code> attribute.</dd>
 
      <dt><span data-x="link options crossorigin">crossorigin</span></dt>
      <dd>the state of <var>el</var>'s <code data-x="attr-link-crossorigin">crossorigin</code>
@@ -16037,7 +16038,7 @@ interface <dfn interface>HTMLLinkElement</dfn> : <span>HTMLElement</span> {
    <li><p>If <var>attribs</var>["<code data-x="attr-link-as">as</code>"] <span data-x="map
    exists">exists</span>, then set <var>options</var>'s <span data-x="link options
    destination">destination</span> to the result of <span
-   data-x="concept-potential-destination-translate">translating</span> <var>attribs</var>["<code
+   data-x="translate a preload destination">translating</span> <var>attribs</var>["<code
    data-x="attr-link-as">as</code>"].</p></li>
 
    <li><p>If <var>attribs</var>["<code data-x="attr-link-crossorigin">crossorigin</code>"] <span
@@ -27566,6 +27567,18 @@ document.body.appendChild(wbr);</code></pre>
   <span data-x="preload credentials mode">credentials mode</span> is <var>request</var>'s <span
   data-x="concept-request-credentials-mode">credentials mode</span>.</p>
 
+  <p>To <dfn>translate a preload destination</dfn> given a string <var>destination</var>:</p>
+
+  <ol>
+   <li><p>If destination is not "<code data-x="">fetch</code>", "<code data-x="">font</code>",
+   "<code data-x="">image</code>", "<code data-x="">script</code>", "<code data-x="">style</code>",
+   or "<code data-x="">track</code>", then return null.</p></li>
+
+   <li><p>Return the result of <span
+   data-x="concept-potential-destination-translate">translating</span>
+   <var>destination</var>.</p></li>
+  </ol>
+
   <p>To <dfn>preload</dfn> given a <span
   data-x="link processing options">link processing options</span> <var>options</var> and
   an optional <var>processResponse</var>, which is an algorithm accepting a <span