josdejong/jsoneditor

Add support for Trusted Types

Open

#1,621 opened on Oct 23, 2024

View on GitHub
 (3 comments) (0 reactions) (0 assignees)JavaScript (2,034 forks)batch import
featurehelp wanted

Repository metrics

Stars
 (10,781 stars)
PR merge metrics
 (Avg merge 15h 36m) (3 merged PRs in 30d)

Description

Hello,

I'm using your great library on angular with the @maaxgr/ang-jsoneditor (14.0.0) wrapper & jsoneditor (10.1.0).

I recently started implementing Trusted Types for security reasons and find myself unable to authorize in my CSP the jsoneditor due to a lack of trusted type usage.

image

As it is still experimental I would get it if you want to wait before implementing this, but the polyfill-like approach could be used to mitigate risk if they make breaking changes in the future.

Could you please add support for it ?

Thanks !

Contributor guide

Research direction
Implement Trusted Types support by using the TrustedTypes API to create and enforce trusted HTML and script sinks. Review the codebase for places where innerHTML, document.write, or similar methods are used and replace them with trusted types. Consult the MDN documentation on Trusted Types and consider using a polyfill for broader compatibility.
Tech stack
javascript
Domain
frontendsecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
JavaScriptDOMCSP
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60