ed20771194
This commit adds a policy, and make use of it in the Content-Security-Policy. I've tested it the best I could, both on a modern browser supporting trusted-types (Chrome) and on one that doesn't (firefox). Thanks to @lweichselbaum for giving me a hand to wrap this up!
15 lines
405 B
JavaScript
15 lines
405 B
JavaScript
let ttpolicy;
|
|
if (window.trustedTypes && trustedTypes.createPolicy) {
|
|
//TODO: use an allow-list for `createScriptURL`
|
|
if (!ttpolicy) {
|
|
ttpolicy = trustedTypes.createPolicy('ttpolicy', {
|
|
createScriptURL: src => src,
|
|
createHTML: html => html,
|
|
});
|
|
}
|
|
} else {
|
|
ttpolicy = {
|
|
createScriptURL: src => src,
|
|
createHTML: html => html,
|
|
};
|
|
}
|