Introduced a 'url-allow-http' keyword to the CSP configuration.

If present in trusted-types directive, it will treat all http: and https: URLs like TrustedURLs. Fixes w3c#65. Such behavior still allows the sites to have a custom, type-only policy for URL sinks (even for policies that allow javascript: URLs and custom schemes), while allowing a relaxed (but DOM-XSS free) for sites that commonly use regular http(s): URLs in URL sinks.
koto · Jun 28, 2018 · 22b81d0 · 22b81d0
1 parent ee94f57
commit 22b81d0
Show file tree

Hide file tree

Showing 8 changed files with 158 additions and 48 deletions.
diff --git a/dist/es5/trustedtypes.build.js b/dist/es5/trustedtypes.build.js
diff --git a/dist/es5/trustedtypes.build.js.map b/dist/es5/trustedtypes.build.js.map
diff --git a/dist/es6/trustedtypes.build.js b/dist/es6/trustedtypes.build.js