Prevent DOM-based XSS with Trusted Types and Content Security Policy with report-uri
The CSP response header:
Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://viet.has.report/report
Trusted Types with a default policy
<script>
trustedTypes.createPolicy('default', {
createHTML: string => string.replaceAll('<', '<'),
});
document.getElementById('prompt-html').onclick = function() {
const html = prompt('Enter any HTML', 'foo <strong>bar</strong>');
if (html) {
document.getElementById('html-me').innerHTML = html;
}
}
</script>
Related specs & documents
- Trusted Types Editor's Draft
- Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types on web.dev
- Trusted Types API on MDN