search

QwikDev / partytown

Relocate resource intensive third-party scripts off of the main thread and into a web worker. 🎉
https://partytown.qwik.dev
MIT License
13.12k stars 438 forks source link

Partytown compatibility with CSP Trusted Types #251

Open exequiel09 opened 2 years ago

exequiel09 commented 2 years ago

Describe the bug I recently tried enabling CSP Trusted Types with a site that uses partytown and it throws errors about TrustedScript assignment on these specific files

https://github.com/BuilderIO/partytown/blob/0a06db0e2034188a6330d51eb6ab06cce90ecb6d/src/lib/web-worker/worker-exec.ts#L121

Screen Shot 2022-09-10 at 12 23 45 PM

https://github.com/BuilderIO/partytown/blob/0a06db0e2034188a6330d51eb6ab06cce90ecb6d/src/lib/web-worker/init-web-worker.ts#L29

Screen Shot 2022-09-10 at 12 23 31 PM Screen Shot 2022-09-10 at 12 22 46 PM

I do think to fix this, partytown should ship their own Trusted Type policy and let consumers add the policy via the trusted-types CSP directive. I'm not a security expert so I'll leave the implementation of custom Trusted Type policy to the ones who can 😅

To Reproduce Steps to reproduce the behavior:

  1. Add Partytown to a website
  2. Add CSP rule that enables trusted types

Reproduction link Please include a link to a Stackblitz or Codesandbox reproducing the issue. We will need to see the issue reproduced with hand-written code - we can't debug giant minified third party scripts directly. If you do not include a clean and simple reproduction of your issue, we won't be able to look into it until you do.

Expected behavior It should not complain when running a site with Trusted Types enabled

Partytown version 0.6.4

github-actions[bot] commented 1 week ago

Partytown moves to QwikDev organization, this is a new beginning for the project. So it's time to clarify the status and clean up the current state a bit. This issue was automatically marked as deprecated and closed because it was not detected recent activity for 8 months, date of latest version. If this issue is still relevant, feel free to comment below and the maintainers will reopen it. Thank you for your contributions.

exequiel09 commented 1 week ago

We still need to have trusted types support :)

gioboa commented 1 week ago

Thanks @exequiel09 for your help