search

w3c / trusted-types

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
https://w3c.github.io/trusted-types/dist/spec/
Other
600 stars 70 forks source link

Update support for dynamic code compilation #464

Closed lukewarlow closed 6 months ago

lukewarlow commented 7 months ago

Move checks to ensure the args are trusted to TT spec from Ecmascript proposal

Update to TC39 proposal: https://github.com/tc39/proposal-dynamic-code-brand-checks/pull/11

Preview | Diff

lukewarlow commented 7 months ago

This also fixes an issue where TT conflated is code like with is a trusted script, which while true now isn't guarunteed to always hold true.