↩ Back Reports

DOM-based XSS Injection Sinks Detection with Trusted Types and Content Security Policy with `report-uri`

The CSPRO (CSP Report-Only) response header:

Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://proud.has.report/report

DOM-based XSS

show the code ▼

<script>
  document.getElementById('prompt-xss').onclick = function() {
    const html = prompt('Enter any HTML', 'foo <strong>bar</strong>');
    if (html) {
      document.getElementById('xss-me').innerHTML = html;
    }
  }
</script>

Related specs & documents

Trusted Types Editor's Draft
Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types on web.dev
Trusted Types API on MDN