josdejong/jsoneditor

Add support for Trusted Types

Open

#1,621 opened on Oct 23, 2024

View on GitHub
 (3 comments) (0 reactions) (0 assignees)JavaScript (10,781 stars) (2,034 forks)batch import
featurehelp wanted

Description

Hello,

I'm using your great library on angular with the @maaxgr/ang-jsoneditor (14.0.0) wrapper & jsoneditor (10.1.0).

I recently started implementing Trusted Types for security reasons and find myself unable to authorize in my CSP the jsoneditor due to a lack of trusted type usage.

image

As it is still experimental I would get it if you want to wait before implementing this, but the polyfill-like approach could be used to mitigate risk if they make breaking changes in the future.

Could you please add support for it ?

Thanks !

Contributor guide

Tech stack
javascripthtmlcss
Domain
frontendsecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
needs maintainer response
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Basic JavaScriptUnderstanding of Content Security PolicyFamiliarity with DOM manipulation
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Investigate the jsoneditor source code (likely in src/) to identify all locations where dangerous DOM APIs (e.g., innerHTML, insertAdjacentHTML) are used. Create a Trusted Types policy using `trustedTypes.createPolicy` that sanitizes HTML. Modify those code locations to use the policy. Consider using the `trusted types` polyfill for browser compatibility. Refer to MDN documentation on Trusted Types and existing examples in other libraries.