From ee183ca70e6fe8cdc4f8db1fe5b976c5a4bbbe65 Mon Sep 17 00:00:00 2001 From: Rachel Andrew Date: Tue, 16 Mar 2021 16:04:44 +0000 Subject: [PATCH 01/20] Adds TrustedTypePolicyFactory --- .../createpolicy/index.html | 70 ++++++++++++++++ .../defaultpolicy/index.html | 51 ++++++++++++ .../emptyhtml/index.html | 49 ++++++++++++ .../emptyscript/index.html | 52 ++++++++++++ .../getattributetype/index.html | 70 ++++++++++++++++ .../getpropertytype/index.html | 68 ++++++++++++++++ .../api/trustedtypepolicyfactory/index.html | 79 +++++++++++++++++++ .../ishtml/index.html | 68 ++++++++++++++++ .../isscript/index.html | 68 ++++++++++++++++ .../isscripturl/index.html | 68 ++++++++++++++++ 10 files changed, 643 insertions(+) create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/defaultpolicy/index.html create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/emptyhtml/index.html create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/index.html create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html create mode 100644 files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html diff --git a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html new file mode 100644 index 000000000000000..412152eec5d57c0 --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html @@ -0,0 +1,70 @@ +--- +title: TrustedTypePolicyFactory.createPolicy() +slug: Web/API/TrustedTypePolicyFactory/createPolicy +tags: + - API + - Method + - Reference + - createPolicy + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The createPolicy() method of the {{domxref("TrustedTypePolicyFactory")}} interface creates a {{domxref("TrustedTypePolicy")}} object that implements the rules passed as policyOptions.

+ +

Syntax

+ +
var policy = TrustedTypePolicyFactory.createPolicy(policyName,policyOptions);
+ +

Parameters

+ +
+
policyName
+
A {{domxref("DOMString")}} with the name of the policy.
+
policyOptions{{optional_inline}}
+
A {{domxref("TrustedTypePolicyOptions")}} dictionary of user-defined functions for converting strings into trusted values.
+
+ +

Return value

+ +

A {{domxref("TrustedTypePolicy")}} object.

+ +

Exceptions

+ +
+
{{jsxref("TypeError")}}
+
Thrown if policy names are restricted by the Content Security Policy trusted-types directive and this name is not on the allowlist.
+
{{jsxref("TypeError")}}
+
Thrown if the name is a duplicate and the Content Security Policy trusted-types directive is not using allow-duplicates.
+
+ +

Examples

+ +

The below code creates a policy with the name myEscapePolicy with a function defined for createHTML which sanitizes HTML.

+ +
const escapeHTMLPolicy = trustedTypes.createPolicy("myEscapePolicy", {
+  createHTML: (string) => string.replace(/\>/g, "<")
+});
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#dom-trustedtypepolicyfactory-createpolicy','TrustedTypePolicyFactory.createPolicy()')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory.createPolicy")}}

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/defaultpolicy/index.html b/files/en-us/web/api/trustedtypepolicyfactory/defaultpolicy/index.html new file mode 100644 index 000000000000000..ce00b29eee40161 --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/defaultpolicy/index.html @@ -0,0 +1,51 @@ +--- +title: TrustedTypePolicyFactory.defaultPolicy +slug: Web/API/TrustedTypePolicyFactory/defaultPolicy +tags: + - API + - Property + - Reference + - defaultPolicy + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The defaultPolicy read-only property of the {{domxref("TrustedTypePolicyFactory")}} interface returns the default {{domxref("TrustedTypePolicy")}} or null if this is empty.

+ +

Syntax

+ +
var defaultPolicy = TrustedTypePolicyFactory.defaultPolicy;
+ +

Value

+

A {{domxref("TrustedTypePolicy")}} or null.

+ +

Examples

+ +

The first line below returns null as no default policy has been created. Once a default policy is created, calling defaultPolicy returns that policy object.

+ +
console.log(trustedTypes.defaultPolicy); // null
+const dp = trustedTypes.createPolicy('default', {});
+console.log(trustedTypes.defaultPolicy); // a TrustedTypePolicy object
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#dom-trustedtypepolicyfactory-defaultpolicy','TrustedTypePolicyFactory.defaultPolicy')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory.defaultPolicy")}}

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/emptyhtml/index.html b/files/en-us/web/api/trustedtypepolicyfactory/emptyhtml/index.html new file mode 100644 index 000000000000000..b234116e2a7cfde --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/emptyhtml/index.html @@ -0,0 +1,49 @@ +--- +title: TrustedTypePolicyFactory.emptyHTML +slug: Web/API/TrustedTypePolicyFactory/emptyHTML +tags: + - API + - Property + - Reference + - emptyHTML + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The emptyHTML read-only property of the {{domxref("TrustedTypePolicyFactory")}} interface returns a {{domxref("TrustedHTML")}} object containing an empty string.

+ +

Syntax

+ +
var emptyHTML = TrustedTypePolicyFactory.emptyHTML;
+ +

Value

+

A {{domxref("TrustedHTML")}} object.

+ +

Examples

+ +

In the below example an empty string is to be inserted into the element. Therefore there is no need to create a policy, and the emptyHTML property can be used to insert the empty element when a Trusted Types object is expected.

+ +
el.innerHTML = trustedTypes.emptyHTML;
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#dom-trustedtypepolicyfactory-emptyhtml','TrustedTypePolicyFactory.emptyHTML')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory.emptyHTML")}}

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html b/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html new file mode 100644 index 000000000000000..fbad8ececc0dea2 --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html @@ -0,0 +1,52 @@ +--- +title: TrustedTypePolicyFactory.emptyScript +slug: Web/API/TrustedTypePolicyFactory/emptyScript +tags: + - API + - Property + - Reference + - emptyScript + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The emptyScript read-only property of the {{domxref("TrustedTypePolicyFactory")}} interface returns a {{domxref("TrustedScript")}} object containing an empty string.

+ +

Syntax

+ +
var emptyScript = TrustedTypePolicyFactory.emptyScript;
+ +

Value

+

A {{domxref("TrustedScript")}} object.

+ +

Examples

+ +

The specification explains that the emptyScript object can be used to detect support for dynamic code compilation.

+ +

Native Trusted Types implementations can support eval(TrustedScript), therefore in the below example in a native implementation will return false for eval(trustedTypes.emptyScript). A polyfill will return a truthy object.

+ +
const supportsTS = !eval(trustedTypes.emptyScript);
+eval(supportsTS ? myTrustedScriptObj : myTrustedScriptObj.toString());
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#dom-trustedtypepolicyfactory-emptyscript','TrustedTypePolicyFactory.emptyScript')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory.emptyScript")}}

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html b/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html new file mode 100644 index 000000000000000..a06b6a94e1c7e21 --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html @@ -0,0 +1,70 @@ +--- +title: TrustedTypePolicyFactory.getAttributeType() +slug: Web/API/TrustedTypePolicyFactory/getAttributeType +tags: + - API + - Method + - Reference + - getAttributeType + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The getAttributeType() method of the {{domxref("TrustedTypePolicyFactory")}} interface allows web developers to check if a Trusted Type is required for an element, and if so which Trusted Type is used.

+ +

Syntax

+ +
var attributeType = TrustedTypePolicyFactory.getAttributeType(tagName,attribute[,elementNs,attrNs]);
+ +

Parameters

+ +
+
tagName
+
A {{domxref("DOMString","string")}} containing the name of an HTML tag.
+
attribute
+
A {{domxref("DOMString","string")}} containing an attribute.
+
elementNs{{optional_inline}}
+
A {{domxref("DOMString","string")}} containing a namespace.
+
attrNs{{optional_inline}}
+
A {{domxref("DOMString","string")}} containing a namespace.
+
+ +

Return value

+ +

A {{domxref("DOMString","string")}} with one of:

+ + +

Or, null.

+ +

Examples

+ +

In this example, passing the {{htmlelement("script")}} element and {{htmlattrxref("src")}} attribute to getAttributeType returns "TrustedScriptURL".

+ +
console.log(trustedTypes.getAttributeType('script', 'src')); // "TrustedScriptURL"
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#dom-trustedtypepolicyfactory-getattributetype','TrustedTypePolicyFactory.getAttributeType()')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory.getAttributeType")}}

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html b/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html new file mode 100644 index 000000000000000..08caa9d1e0a3bde --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html @@ -0,0 +1,68 @@ +--- +title: TrustedTypePolicyFactory.getPropertyType() +slug: Web/API/TrustedTypePolicyFactory/getPropertyType +tags: + - API + - Method + - Reference + - getPropertyType + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The getPropertyType() method of the {{domxref("TrustedTypePolicyFactory")}} interface allows web developers to check if a Trusted Type is required for an element's property.

+ +

Syntax

+ +
var null = TrustedTypePolicyFactory.getPropertyType(tagName,property[, elementNS]);
+ +

Parameters

+ +
+
tagName
+
A {{domxref("DOMString","string")}} containing the name of an HTML tag.
+
property
+
A {{domxref("DOMString","string")}} containing a property, for example "innerHTML".
+
elementNs{{optional_inline}}
+
A {{domxref("DOMString","string")}} containing a namespace.
+
+ +

Return value

+ +

A {{domxref("DOMString","string")}} with one of:

+ + +

Or, null.

+ +

Examples

+ +

In this example, passing the {{htmlelement("div")}} element and innerHTML property to getPropertyType returns "TrustedHTML".

+ +
console.log(trustedTypes.getPropertyType('div', 'innerHTML')); // "TrustedHTML"
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#dom-trustedtypepolicyfactory-getpropertytype','TrustedTypePolicyFactory.getPropertyType()')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory.getPropertyType")}}

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/index.html b/files/en-us/web/api/trustedtypepolicyfactory/index.html new file mode 100644 index 000000000000000..8a0a03a322c9bf9 --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/index.html @@ -0,0 +1,79 @@ +--- +title: TrustedTypePolicyFactory +slug: Web/API/TrustedTypePolicyFactory +tags: + - API + - Interface + - Reference + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The TrustedTypePolicyFactory interface of the {{domxref('Trusted Types API')}} creates policies and allows the verification of Trusted Type objects against created policies.

+ + +

Properties

+ +
+
{{domxref("TrustedTypePolicyFactory.emptyHTML")}}{{ReadOnlyInline}}
+
Returns a {{domxref("TrustedHTML")}} object containing an empty string.
+
{{domxref("TrustedTypePolicyFactory.emptyScript")}}{{ReadOnlyInline}}
+
Returns a {{domxref("TrustedScript")}} object containing an empty string.
+
{{domxref("TrustedTypePolicyFactory.defaultPolicy")}}{{ReadOnlyInline}}
+
Returns the default {{domxref("TrustedTypePolicy")}} or null if this is empty.
+
+ +

Methods

+ +
+
{{domxref("TrustedTypePolicyFactory.createPolicy()")}}
+
Creates a {{domxref("TrustedTypePolicy")}} object that implements the rules passed as policyOptions.
+
{{domxref("TrustedTypePolicyFactory.isHTML()")}}
+
When passed a value checks that it is a valid {{domxref("TrustedHTML")}} object.
+
{{domxref("TrustedTypePolicyFactory.isScript()")}}
+
When passed a value checks that it is a valid {{domxref("TrustedScript")}} object.
+
{{domxref("TrustedTypePolicyFactory.isScriptURL()")}}
+
When passed a value checks that it is a valid {{domxref("TrustedScriptURL")}} object.
+
{{domxref("TrustedTypePolicyFactory.getAttributeType()")}}
+
Allows web developers to check whether a Trusted Type is required for an element and attribute, and if so which one.
+
{{domxref("TrustedTypePolicyFactory.getPropertyType()")}}
+
Allows web developers to check whether a Trusted Type is required for a property, and if so which one.
+
+ +

Examples

+ +

The below code creates a policy with the name myEscapePolicy with a function defined for createHTML which sanitizes HTML.

+ +

We then use the policy to sanitize a string, creating a {{domxref("TrustedHTML")}} object, escaped. This object can be tested with {{domxref("TrustedTypePolicyFactory.isHTML","isHTML()")}} to ensure that it was created by one of our policies.

+ +
const escapeHTMLPolicy = trustedTypes.createPolicy("myEscapePolicy", {
+  createHTML: (string) => string.replace(/\>/g, "<")
+});
+
+const escaped = escapeHTMLPolicy.createHTML("<img src=x onerror=alert(1)>");
+
+console.log(trustedTypes.isHTML(escaped)) // true;
+
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#trusted-type-policy-factory','TrustedTypePolicyFactory')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory")}}

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html b/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html new file mode 100644 index 000000000000000..46858afe41f0901 --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html @@ -0,0 +1,68 @@ +--- +title: TrustedTypePolicyFactory.isHTML() +slug: Web/API/TrustedTypePolicyFactory/isHTML +tags: + - API + - Method + - Reference + - isHTML + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The isHTML() method of the {{domxref("TrustedTypePolicyFactory")}} interface returns true if it is passed a valid {{domxref("TrustedHTML")}} object.

+ +
+

Note:

+

The purpose of the functions isHTML, {{domxref("TrustedTypePolicyFactory.isScript","isScript()")}}, and {{domxref("TrustedTypePolicyFactory.isScriptURL","isScriptURL()")}} is to check if the object is a valid TrustedType object, created by a configured policy.

+
+ +

Syntax

+ +
var isHTML = TrustedTypePolicyFactory.isHTML(value);
+ +

Parameters

+ +
+
value
+
A {{domxref("TrustedHTML")}} object.
+
+ +

Return value

+ +

A {{jsxref("boolean")}}, true if the object is a valid {{domxref("TrustedHTML")}} object.

+ +

Examples

+ +

In the below example the constant html was created by a policy, and therefore isHTML returns true. The second example is an attempt to fake an object, and the third is a string. Both of these will return false when passed to isHTML.

+ +
const html = policy.createHTML('
');
+console.log(trustedTypes.isHTML(html)) // true;
+
+const fake = Object.create(TrustedHTML.prototype);
+console.log(trustedTypes.isHTML(fake)); // false
+
+console.log(trustedTypes.isHTML("
plain string
")); // false
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#dom-trustedtypepolicyfactory-ishtml','TrustedTypePolicyFactory.isHTML()')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory.isHTML")}}

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html b/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html new file mode 100644 index 000000000000000..6e11ba7c4883917 --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html @@ -0,0 +1,68 @@ +--- +title: TrustedTypePolicyFactory.isScript() +slug: Web/API/TrustedTypePolicyFactory/isScript +tags: + - API + - Method + - Reference + - isScript + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The isScript() method of the {{domxref("TrustedTypePolicyFactory")}} interface returns true if it is passed a valid {{domxref("TrustedScript")}} object.

+ +
+

Note:

+

The purpose of the functions isScript, {{domxref("TrustedTypePolicyFactory.isHTML","isHTML()")}}, and {{domxref("TrustedTypePolicyFactory.isScriptURL","isScriptURL()")}} is to check if the object is a valid TrustedType object, created by a configured policy.

+
+ +

Syntax

+ +
var isScript = TrustedTypePolicyFactory.isScript(value);
+ +

Parameters

+ +
+
value
+
A {{domxref("TrustedScript")}} object.
+
+ +

Return value

+ +

A {{jsxref("boolean")}}, true if the object is a valid {{domxref("TrustedScript")}} object.

+ +

Examples

+ +

In the below example the constant url was created by a policy, and therefore isScriptURL returns true. The second example is an attempt to fake an object, and the third is a string. Both of these will return false when passed to isScriptURL.

+ +
const myScript = policy.createScript("eval('2 + 2')");
+console.log(trustedTypes.isScript(myScript)) // true;
+
+const fake = Object.create(TrustedScript.prototype);
+console.log(trustedTypes.isScript(fake)); // false
+
+console.log(trustedTypes.isScript("eval('2 + 2')")); // false
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#dom-trustedtypepolicyfactory-isscript','TrustedTypePolicyFactory.isScript()')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory.isScript")}}

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html b/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html new file mode 100644 index 000000000000000..d1934ad2e720828 --- /dev/null +++ b/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html @@ -0,0 +1,68 @@ +--- +title: TrustedTypePolicyFactory.isScriptURL() +slug: Web/API/TrustedTypePolicyFactory/isScriptURL +tags: + - API + - Method + - Reference + - isScriptURL + - TrustedTypePolicyFactory +--- +
{{DefaultAPISidebar("Trusted Types API")}}
+ +

The isScriptURL() method of the {{domxref("TrustedTypePolicyFactory")}} interface returns true if it is passed a valid {{domxref("TrustedScriptURL")}} object.

+ +
+

Note:

+

The purpose of the functions isScriptURL, {{domxref("TrustedTypePolicyFactory.isHTML","isHTML()")}}, and {{domxref("TrustedTypePolicyFactory.isScript","isScript()")}} is to check if the object is a valid TrustedType object, created by a configured policy.

+
+ +

Syntax

+ +
var isScriptURL = TrustedTypePolicyFactory.isScriptURL(value);
+ +

Parameters

+ +
+
value
+
A {{domxref("TrustedScriptURL")}} object.
+
+ +

Return value

+ +

A {{jsxref("boolean")}}, true if the object is a valid {{domxref("TrustedScriptURL")}} object.

+ +

Examples

+ +

In the below example the constant url was created by a policy, and therefore isScriptURL returns true. The second example is an attempt to fake an object, and the third is a string. Both of these will return false when passed to isScriptURL.

+ +
const url = policy.createScriptURL('https://example.com/myscript.js');
+console.log(trustedTypes.isScriptURL(url)) // true;
+
+const fake = Object.create(TrustedScriptURL.prototype);
+console.log(trustedTypes.isScriptURL(fake)); // false
+
+console.log(trustedTypes.isScriptURL("https://example.com/myscript.js")); // false
+ +

Specifications

+ + + + + + + + + + + + + + +
SpecificationStatusComment
{{SpecName('Trusted Types','#dom-trustedtypepolicyfactory-isscripturl','TrustedTypePolicyFactory.isScriptURL()')}}{{Spec2('Trusted Types')}}Initial definition.
+ +

Browser compatibility

+ + + +

{{Compat("api.TrustedTypePolicyFactory.isScriptURL")}}

From c18ef8722b086b9b0a050e68aa06d2662d432a86 Mon Sep 17 00:00:00 2001 From: Rachel Andrew Date: Wed, 17 Mar 2021 07:30:19 +0000 Subject: [PATCH 02/20] Update files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html Co-authored-by: Joe Medley --- .../web/api/trustedtypepolicyfactory/createpolicy/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html index 412152eec5d57c0..64b133ac263d457 100644 --- a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html +++ b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html @@ -33,7 +33,7 @@

Exceptions

{{jsxref("TypeError")}}
-
Thrown if policy names are restricted by the Content Security Policy trusted-types directive and this name is not on the allowlist.
+
Thrown if policy names are restricted by the Content Security Policy `trusted-types` directive and this name is not on the allowlist.
{{jsxref("TypeError")}}
Thrown if the name is a duplicate and the Content Security Policy trusted-types directive is not using allow-duplicates.
From 711fe2d84390d12a42ae2122e650d140a479894a Mon Sep 17 00:00:00 2001 From: Rachel Andrew Date: Wed, 17 Mar 2021 07:30:35 +0000 Subject: [PATCH 03/20] Update files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html Co-authored-by: Joe Medley --- .../web/api/trustedtypepolicyfactory/createpolicy/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html index 64b133ac263d457..d0541a27c99703a 100644 --- a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html +++ b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html @@ -40,7 +40,7 @@

Exceptions

Examples

-

The below code creates a policy with the name myEscapePolicy with a function defined for createHTML which sanitizes HTML.

+

The below code creates a policy with the name "myEscapePolicy" with a function defined for createHTML() which sanitizes HTML.

const escapeHTMLPolicy = trustedTypes.createPolicy("myEscapePolicy", {
   createHTML: (string) => string.replace(/\>/g, "<")

From f58fa1390b4d350438a984f239abc752f3c14b47 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:32:19 +0000
Subject: [PATCH 04/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html

Co-authored-by: Joe Medley 
---
 .../en-us/web/api/trustedtypepolicyfactory/isscript/index.html  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html b/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html
index 6e11ba7c4883917..88dbc73307781c7 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html
@@ -30,7 +30,7 @@ 
Parameters

 
 
Return value

 
-
A {{jsxref("boolean")}}, true if the object is a valid {{domxref("TrustedScript")}} object.

+
A {{jsxref("boolean")}} that is true if the object is a valid {{domxref("TrustedScript")}} object.

 
 
Examples

 

From 257c7dfdc63b3f1668d87b2a11f1881d161c3dc6 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:32:31 +0000
Subject: [PATCH 05/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html

Co-authored-by: Joe Medley 
---
 .../en-us/web/api/trustedtypepolicyfactory/isscript/index.html  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html b/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html
index 88dbc73307781c7..a9338409014f22b 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html
@@ -34,7 +34,7 @@ 
Return value

 
 
Examples

 
-
In the below example the constant url was created by a policy, and therefore isScriptURL returns true. The second example is an attempt to fake an object, and the third is a string. Both of these will return false when passed to isScriptURL.

+
In the below example the constant url was created by a policy, and therefore isScriptURL() returns true. The second example is an attempt to fake an object, and the third is a string. Both of these will return false when passed to isScriptURL().

 
 
const myScript = policy.createScript("eval('2 + 2')");
 console.log(trustedTypes.isScript(myScript)) // true;

From cb6b2ac9ebce3788512c5e20cb8ae0ea3e498dd4 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:32:45 +0000
Subject: [PATCH 06/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html

Co-authored-by: Joe Medley 
---
 .../web/api/trustedtypepolicyfactory/isscripturl/index.html     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html b/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html
index d1934ad2e720828..8363484485e3a9f 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html
@@ -14,7 +14,7 @@
 
 

   
Note:

-  
The purpose of the functions isScriptURL, {{domxref("TrustedTypePolicyFactory.isHTML","isHTML()")}}, and {{domxref("TrustedTypePolicyFactory.isScript","isScript()")}} is to check if the object is a valid TrustedType object, created by a configured policy.

+  
The purpose of the functions isScriptURL(), {{domxref("TrustedTypePolicyFactory.isHTML","isHTML()")}}, and {{domxref("TrustedTypePolicyFactory.isScript","isScript()")}} is to check if the object is a valid TrustedType object, created by a configured policy.

 

 
 
Syntax


From da4bd4ca5d088a95bb0e5e2d9c934133d697c68e Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:32:52 +0000
Subject: [PATCH 07/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html

Co-authored-by: Joe Medley 
---
 .../web/api/trustedtypepolicyfactory/isscripturl/index.html     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html b/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html
index 8363484485e3a9f..e70c2e5ec0a69bb 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html
@@ -30,7 +30,7 @@ 
Parameters

 
 
Return value

 
-
A {{jsxref("boolean")}}, true if the object is a valid {{domxref("TrustedScriptURL")}} object.

+
A {{jsxref("boolean")}}that is true if the object is a valid {{domxref("TrustedScriptURL")}} object.

 
 
Examples

 

From 4314369631620c3627b6e47046c104592a3dd677 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:33:00 +0000
Subject: [PATCH 08/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html

Co-authored-by: Joe Medley 
---
 .../web/api/trustedtypepolicyfactory/isscripturl/index.html     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html b/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html
index e70c2e5ec0a69bb..19e546ea8c60d48 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/isscripturl/index.html
@@ -34,7 +34,7 @@ 
Return value

 
 
Examples

 
-
In the below example the constant url was created by a policy, and therefore isScriptURL returns true. The second example is an attempt to fake an object, and the third is a string. Both of these will return false when passed to isScriptURL.

+
In the below example the constant url was created by a policy, and therefore isScriptURL() returns true. The second example is an attempt to fake an object, and the third is a string. Both of these will return false when passed to isScriptURL().

 
 
const url = policy.createScriptURL('https://example.com/myscript.js');
 console.log(trustedTypes.isScriptURL(url)) // true;

From 08ea1b0e5704c022b891ba8c4311177d333a5f26 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:35:45 +0000
Subject: [PATCH 09/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html

Co-authored-by: Joe Medley 
---
 .../web/api/trustedtypepolicyfactory/emptyscript/index.html     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html b/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html
index fbad8ececc0dea2..88a379e23ff0835 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html
@@ -23,7 +23,7 @@ 
Examples

 
 
The specification explains that the emptyScript object can be used to detect support for dynamic code compilation.

 
-
Native Trusted Types implementations can support eval(TrustedScript), therefore in the below example in a native implementation will return false for eval(trustedTypes.emptyScript). A polyfill will return a truthy object.

+
Native Trusted Types implementations can support eval(TrustedScript), therefore in the below example a native implementation will return false for eval(trustedTypes.emptyScript). A polyfill will return a truthy object.

 
 
const supportsTS = !eval(trustedTypes.emptyScript);
 eval(supportsTS ? myTrustedScriptObj : myTrustedScriptObj.toString());


From 7c5aadb26266a4987af34ce1ae3451987fa30c29 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:37:27 +0000
Subject: [PATCH 10/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html

Co-authored-by: Joe Medley 
---
 .../trustedtypepolicyfactory/getattributetype/index.html    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html b/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html
index a06b6a94e1c7e21..ea216470cfcb3c1 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html
@@ -33,9 +33,9 @@ 
Return value

 
 
A {{domxref("DOMString","string")}} with one of:

 
    
-  
  • "TrustedHTML"
    • 
-  
  • "TrustedScript"
    • 
-  
  • "TrustedScriptURL
    • 
+  
  • "TrustedHTML"
    • 
+  
  • "TrustedScript"
    • 
+  
  • "TrustedScriptURL"
    • 
 

 
 
Or, null.


From d635d3edb7cdc875267fe6d1f306b68dc9846e8c Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:37:58 +0000
Subject: [PATCH 11/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html

Co-authored-by: Joe Medley 
---
 .../api/trustedtypepolicyfactory/getpropertytype/index.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html b/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html
index 08caa9d1e0a3bde..59fa9f5784135c6 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html
@@ -31,9 +31,9 @@ 
Return value

 
 
A {{domxref("DOMString","string")}} with one of:

 
    
-  
  • "TrustedHTML"
    • 
-  
  • "TrustedScript"
    • 
-  
  • "TrustedScriptURL
    • 
+  
  • "TrustedHTML"
    • 
+  
  • "TrustedScript"
    • 
+  
  • "TrustedScriptURL"
    • 
 

 
 
Or, null.


From 567672900510b8e6cc528a256d1316e6c1753d1d Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:38:17 +0000
Subject: [PATCH 12/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/index.html

Co-authored-by: Joe Medley 
---
 files/en-us/web/api/trustedtypepolicyfactory/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/index.html b/files/en-us/web/api/trustedtypepolicyfactory/index.html
index 8a0a03a322c9bf9..9a4c79b3dbbf5ad 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/index.html
@@ -42,7 +42,7 @@ 
Methods

 
 
Examples

 
-
The below code creates a policy with the name myEscapePolicy with a function defined for createHTML which sanitizes HTML.

+
The below code creates a policy with the name "myEscapePolicy" with a function defined for createHTML() which sanitizes HTML.

 
 
We then use the policy to sanitize a string, creating a {{domxref("TrustedHTML")}} object, escaped. This object can be tested with {{domxref("TrustedTypePolicyFactory.isHTML","isHTML()")}} to ensure that it was created by one of our policies.

 

From 054cc24885ac02c5c1f92481ab239514db6f900f Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:38:53 +0000
Subject: [PATCH 13/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html

Co-authored-by: Joe Medley 
---
 files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html b/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html
index 46858afe41f0901..34d04cc51a22f23 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html
@@ -14,7 +14,7 @@
 
 

   
Note:

-  
The purpose of the functions isHTML, {{domxref("TrustedTypePolicyFactory.isScript","isScript()")}}, and {{domxref("TrustedTypePolicyFactory.isScriptURL","isScriptURL()")}} is to check if the object is a valid TrustedType object, created by a configured policy.

+  
The purpose of the functions isHTML(), {{domxref("TrustedTypePolicyFactory.isScript","isScript()")}}, and {{domxref("TrustedTypePolicyFactory.isScriptURL","isScriptURL()")}} is to check if the object is a valid TrustedType object, created by a configured policy.

 

 
 
Syntax


From cfcbdee2b082401a2603b488b0ce9e7a8769a2e3 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:39:17 +0000
Subject: [PATCH 14/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html

Co-authored-by: Joe Medley 
---
 files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html b/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html
index 34d04cc51a22f23..886a0395e38c8fb 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html
@@ -30,7 +30,7 @@ 
Parameters

 
 
Return value

 
-
A {{jsxref("boolean")}}, true if the object is a valid {{domxref("TrustedHTML")}} object.

+
A {{jsxref("boolean")}} that is true if the object is a valid {{domxref("TrustedHTML")}} object.

 
 
Examples

 

From 3e1e04d9129a4138ff19b4ecb3dff7226a22666a Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:39:51 +0000
Subject: [PATCH 15/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html

Co-authored-by: Joe Medley 
---
 files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html b/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html
index 886a0395e38c8fb..da355849589b200 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/ishtml/index.html
@@ -34,7 +34,7 @@ 
Return value

 
 
Examples

 
-
In the below example the constant html was created by a policy, and therefore isHTML returns true. The second example is an attempt to fake an object, and the third is a string. Both of these will return false when passed to isHTML.

+
In the below example the constant html was created by a policy, and therefore isHTML() returns true. The second example is an attempt to fake an object, and the third is a string. Both of these will return false when passed to isHTML().

 
 
const html = policy.createHTML('
');
 console.log(trustedTypes.isHTML(html)) // true;

From fb8a0bdda983325051e9a45d7365aafb7909ead6 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Wed, 17 Mar 2021 07:40:08 +0000
Subject: [PATCH 16/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html

Co-authored-by: Joe Medley 
---
 .../en-us/web/api/trustedtypepolicyfactory/isscript/index.html  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html b/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html
index a9338409014f22b..56c66513b60d064 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/isscript/index.html
@@ -14,7 +14,7 @@
 
 

   
Note:

-  
The purpose of the functions isScript, {{domxref("TrustedTypePolicyFactory.isHTML","isHTML()")}}, and {{domxref("TrustedTypePolicyFactory.isScriptURL","isScriptURL()")}} is to check if the object is a valid TrustedType object, created by a configured policy.

+  
The purpose of the functions isScript(), {{domxref("TrustedTypePolicyFactory.isHTML","isHTML()")}}, and {{domxref("TrustedTypePolicyFactory.isScriptURL","isScriptURL()")}} is to check if the object is a valid TrustedType object, created by a configured policy.

 

 
 
Syntax


From 79161099d3424267efba7b28d62667327f58f5f8 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Tue, 23 Mar 2021 09:57:12 +0000
Subject: [PATCH 17/20] Update
 files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html

Co-authored-by: Joe Medley 
---
 .../web/api/trustedtypepolicyfactory/createpolicy/index.html    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html
index d0541a27c99703a..872dc0f99b23fb9 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html
@@ -33,7 +33,7 @@ 
Exceptions

 
 

   
{{jsxref("TypeError")}}

-  
Thrown if policy names are restricted by the Content Security Policy `trusted-types` directive and this name is not on the allowlist.

+  
Thrown if policy names are restricted by the Content Security Policy trusted-types directive and this name is not on the allowlist.

   
{{jsxref("TypeError")}}

   
Thrown if the name is a duplicate and the Content Security Policy trusted-types directive is not using allow-duplicates.

 


From 2aef5bf2d0faca5f73c24574fa3f845284bfda13 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Tue, 23 Mar 2021 11:18:37 +0000
Subject: [PATCH 18/20] edits from PR review

---
 .../createpolicy/index.html                   | 34 ++++++++++++++++++-
 .../defaultpolicy/index.html                  |  5 +++
 .../getattributetype/index.html               |  4 +--
 .../getpropertytype/index.html                |  2 +-
 4 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html
index 872dc0f99b23fb9..d627f5bcf0fb688 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html
@@ -12,6 +12,15 @@
 
 
The createPolicy() method of the {{domxref("TrustedTypePolicyFactory")}} interface creates a {{domxref("TrustedTypePolicy")}} object that implements the rules passed as policyOptions.

 
+
The default policy

+
+
Creating a policy with a name of "default" creates a special policy that will be used if a string (rather than a Trusted Type object) is passed to an injection sink. This can be used in a transitional phase while moving from an application that inserted strings into injection sinks.

+
+

+  
Note

+  
A lax default policy could defeat the purpose of using Trusted Types, and therefore should be defined with strict rules to ensure it cannot be used to run dangerous code.

+

+
 
Syntax

 
 
var policy = TrustedTypePolicyFactory.createPolicy(policyName,policyOptions);

@@ -22,7 +31,16 @@ 
Parameters

   
policyName

   
A {{domxref("DOMString")}} with the name of the policy.

   
policyOptions{{optional_inline}}

-  
A {{domxref("TrustedTypePolicyOptions")}} dictionary of user-defined functions for converting strings into trusted values.

+  
User-defined functions for converting strings into trusted values.
+    

+      
CreateHTML(input[,args])

+      
A callback function in the form of a {{domxref("DOMString", "string")}} that contains code to run when creating a {{domxref("TrustedHTML")}} object.

+      
CreateScript(input[,args])

+      
A callback function in the form of a {{domxref("DOMString", "string")}} that contains code to run when creating a {{domxref("TrustedScript")}} object.

+      
CreateScriptURL(input[,args])

+      
A callback function in the form of a {{domxref("DOMString", "string")}} that contains code to run when creating a {{domxref("TrustedScriptURL")}} object.

+    

+  

 
 
 
Return value

@@ -46,6 +64,20 @@ 
Examples

   createHTML: (string) => string.replace(/\>/g, "<")
 });

 
+
Creating a default policy

+
+
On a site where Trusted Types are enforced via a Content Security Policy with the require-trusted-types-for directive set to script, any injection script that accepts a script expects a Trusted Type object. In the case that a string is inserted instead, the following default policy will be used.

+
+
The policy logs a message to the console to remind the developer to refactor this part of the application to use a Trusted Type object. It also appends details of the use of the default policy, type, and injection sink to the returned value.

+
+
trustedTypes.createPolicy('default', {
+  createScriptURL: (s, type, sink) => {
+    console.log("Please refactor.");
+    return s + '?default-policy-used&type=' + encodeURIComponent(type) +
+          '&sink=' + encodeURIComponent(sink);
+  }
+});

+
 
Specifications

 
 
diff --git a/files/en-us/web/api/trustedtypepolicyfactory/defaultpolicy/index.html b/files/en-us/web/api/trustedtypepolicyfactory/defaultpolicy/index.html
index ce00b29eee40161..31888fe0c915a18 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/defaultpolicy/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/defaultpolicy/index.html
@@ -12,6 +12,11 @@
 
 
The defaultPolicy read-only property of the {{domxref("TrustedTypePolicyFactory")}} interface returns the default {{domxref("TrustedTypePolicy")}} or null if this is empty.

 
+

+  
Note

+  
Information about the creation and use of default policies can be found in the createPolicy() documentation.

+

+
 
Syntax
var defaultPolicy = TrustedTypePolicyFactory.defaultPolicy;

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html b/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html
index ea216470cfcb3c1..8f23f172ab8bec1 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/getattributetype/index.html
@@ -24,9 +24,9 @@ 
Parameters
attribute
A {{domxref("DOMString","string")}} containing an attribute.
elementNs{{optional_inline}}

-  
A {{domxref("DOMString","string")}} containing a namespace.

+  
A {{domxref("DOMString","string")}} containing a namespace, if empty defaults to the HTML namespace.
attrNs{{optional_inline}}

-  
A {{domxref("DOMString","string")}} containing a namespace.

+  
A {{domxref("DOMString","string")}} containing a namespace, if empty defaults to null.
Return value

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html b/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html
index 59fa9f5784135c6..9d1d65580c50ffe 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/getpropertytype/index.html
@@ -24,7 +24,7 @@ 
Parameters
property
A {{domxref("DOMString","string")}} containing a property, for example "innerHTML".
elementNs{{optional_inline}}

-  
A {{domxref("DOMString","string")}} containing a namespace.

+  
A {{domxref("DOMString","string")}} containing a namespace, if empty defaults to the HTML namespace.
Return value


From 83726d469bb144619743bcdc9a4d3f7e92942dbf Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Thu, 1 Apr 2021 10:01:13 +0100
Subject: [PATCH 19/20] adding a line about emptyScript and emptyHTML

---
 .../en-us/web/api/trustedtypepolicyfactory/emptyhtml/index.html | 2 ++
 .../web/api/trustedtypepolicyfactory/emptyscript/index.html     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/emptyhtml/index.html b/files/en-us/web/api/trustedtypepolicyfactory/emptyhtml/index.html
index b234116e2a7cfde..efec4d61ca8d914 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/emptyhtml/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/emptyhtml/index.html
@@ -12,6 +12,8 @@
 
 
The emptyHTML read-only property of the {{domxref("TrustedTypePolicyFactory")}} interface returns a {{domxref("TrustedHTML")}} object containing an empty string.

 
+
This object can be used when the application requires an empty string to be inserted into an injection sink.

+
 
Syntax

 
 
var emptyHTML = TrustedTypePolicyFactory.emptyHTML;

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html b/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html
index 88a379e23ff0835..6cb64907ed99665 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/emptyscript/index.html
@@ -12,6 +12,8 @@
 
 
The emptyScript read-only property of the {{domxref("TrustedTypePolicyFactory")}} interface returns a {{domxref("TrustedScript")}} object containing an empty string.

 
+
This object can be used when the application requires an empty string to be inserted into an injection sink which is expecting a TrustedScript object.

+
 
Syntax

 
 
var emptyScript = TrustedTypePolicyFactory.emptyScript;


From 8b3225375ed7455585d826c6fe0793f16f886ca7 Mon Sep 17 00:00:00 2001
From: Rachel Andrew 
Date: Tue, 6 Apr 2021 10:34:41 +0100
Subject: [PATCH 20/20] Adding note re default policy

---
 .../api/trustedtypepolicyfactory/createpolicy/index.html   | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html
index d627f5bcf0fb688..ef547b4d582a67d 100644
--- a/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html
+++ b/files/en-us/web/api/trustedtypepolicyfactory/createpolicy/index.html
@@ -14,7 +14,12 @@
 
 
The default policy

 
-
Creating a policy with a name of "default" creates a special policy that will be used if a string (rather than a Trusted Type object) is passed to an injection sink. This can be used in a transitional phase while moving from an application that inserted strings into injection sinks.

+
In Chrome a policy with a name of "default" creates a special policy that will be used if a string (rather than a Trusted Type object) is passed to an injection sink. This can be used in a transitional phase while moving from an application that inserted strings into injection sinks.

+
+

+  
Note

+  
The above behavior is not yet settled in the specification and may change in future.

+

 
 

   
Note