search

richnologies / ngx-stripe

Angular 6+ wrapper for StripeJS
MIT License
217 stars 77 forks source link

Error on TrustedScriptURL #255

Open ashiksaleeth opened 3 months ago

ashiksaleeth commented 3 months ago

We have enabled trusted types in my angular app and now we are getting a TrustedScriptURL error.

image

most probably due to below url not being sanitized

image

We are using the following versions "ngx-stripe": "^13.4.0" "@stripe/stripe-js": "^1.11.0"

angular version 13.2.0

CSP trusted type configuration-

richnologies commented 3 months ago

Hey @ashiksaleeth, thank you for raising this issue. We are not very familiar with the TrustedTypes API. While we are open to adding support for it, we are unsure of the best implementation approach. Additionally, it appears there is no support for Safari or Firefox, and creating a policy within the library might not be ideal. PRs or suggestions are always welcome

As an alternative, you can load Stripe on your own before the library needs it. The library checks if StripeJS is already loaded, and if so, it does not try to load it again. This might resolve the error.