Open Seirdy opened 2 years ago
I considered making this issue about skipping the trusted-types recommendation even if scripts are present if they don't mess with DOM XSS sinks. I decided against this because adding the necessary script parsing logic to the CSP Evaluator would complicate things.
If a CSP has
script-src: none
or equivalent to forbid script loading, or if it has asandbox
directive to forbid script execution, the CSP evaluator shouldn't recommendrequires-trusted-types-for: script
because there is no script execution happening in the first place.