DOM-based XSS Injection Sinks Detection with Trusted Types and Content Security Policy with report-uri
The CSPRO (CSP Report-Only) response header:
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://thread.has.report/report
DOM-based XSS
<script>
document.getElementById('prompt-xss').onclick = function() {
const html = prompt('Enter any HTML', 'foo <strong>bar</strong>');
if (html) {
document.getElementById('xss-me').innerHTML = html;
}
}
</script>
Related specs & documents
- Trusted Types Editor's Draft
- Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types on web.dev
- Trusted Types API on MDN