Trusted Types: A World Without XSS
summary
Trusted Types blocks DOM XSS by requiring specially created objects (TrustedHTML, TrustedScriptURL) and enforcing them via a CSP header so raw strings cannot be assigned to sinks. Implementation here upgrades an Angular app to v12 and webpack 5, creates a default policy hack to sanitize third‑party markdown, adds a new Angular view for printing instead of document.write, and implements an analytics trusted-script-URL policy. The work takes about eight days part‑time, runs in Chromium, needs a fragile polyfill for other browsers, and ends as a proof‑of‑concept rather than drop‑in production.
AI-written summary · about
chapters (17)
- 0:00Start
- 6:45Easy to create & hard to detect
- 7:55How does Trusted Types fix this?
- 11:52How do you turn it on?
- 12:36How do you create a policy?
- 13:24A Trusted Types policy
- 18:38Angular's guide
- 19:53Webpack lazy loading
- 23:21Solution #1: Upgrading to Angular 12
- 28:42ngx-markdown
- 29:17The 'default' policy
- 34:03ngx-print
- 42:23Analytics Policy
- 46:46Issue #5: TypeScript support
- 46:58(Bad) Solution #5: @ts-nocheck
- 47:39Issue #5: Supporting not-Chromium
- 48:30Locally loading the polyfill
related talks
27mSecuring Angular with Trusted Types
25mSecuring Angular with Trusted Types
36mSecuring the DOM from the Bottom Up
34mDOM XSS Protection at Scale
16mEliminating XSS Angular applications by adopting TT
31mSecuring the DOM from the Bottom Up
59mThe Final Frontier: Security APIs in Modern Browsers
31mAchieving Secure Software through Redesign