Implementing trusted-types CSP
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript, jquery
Research direction
The issue points to the datepicker initialization in jquery-ui around the this.dpDiv assignment at line 7261; start by tracing how that markup is passed through jQuery's HTML parsing and review the relevant Trusted Types behavior. Verify the datepicker can initialize under the reported CSP policy without a default policy, while existing datepicker behavior remains intact; no test file is named in the issue.
Written by the indexing model from the issue text.
Description
Hi,
i updated to jQuery 4.0.0 with jQuery-UI 1.14.2 to enable CSP-Header and add require-trusted-types-for 'script'; trusted-types my-policy
When i add jquery and jquery-ui javascript files to a page an exception happens:
jquery.js:4425 Uncaught (in promise) TypeError: Failed to set the 'innerHTML' property on 'Element': This document requires 'TrustedHTML' assignment.
at buildFragment (:8001/query.js?v=639270686323595707:15468:29)
at jQuery2.parseHTML (:8001/query.js?v=639270686323595707:18412:18)
at new jQuery2.fn.init (:8001/query.js?v=639270686323595707:14404:43)
at jQuery2 (:8001/query.js?v=639270686323595707:12915:16)
at new Datepicker (:8001/query.js?v=639270686323595707:4716:43)
at :8001/query.js?v=639270686323595707:6394:22
at :8001/query.js?v=639270686323595707:35:9
at node_modules/jquery-ui/dist/jquery-ui.js (:8001/query.js?v=639270686323595707:37:7)
at __require (:8001/query.js?v=639270686323595707:8:50)
at :8001/query.js?v=639270686323595707:18712:38
I also use esbuild, so the linenumbers are not the numbers in the original js files.
After debugging i found that the string <div id='ui-datepicker-div' class='ui-datepicker ui-widget ui-widget-content ui-helper-clearfix ui-corner-all'></div> raises the exception.
The string comes from line 7261 in jquery-ui: this.dpDiv = datepicker_bindHover( $( "<div id='" + this._mainDivId + "' class='ui-datepicker ui-widget ui-widget-content ui-helper-clearfix ui-corner-all'></div>" ) );
The workaround is to add a default policy for trusted types. But this should not be necessary. So my request is to add support for Trusted Types.
Thank you
- Dominant language
- JavaScript
- Stars
- 11.3k
- Forks
- 5.2k
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from jquery/jquery-ui
-
Selectmenu changes selection after its native select is disabled while openPossibly taken @Xapollon430 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Datepicker changes a natively disabled input if its calendar is openPossibly taken @Xapollon430 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
-
Comp: Datepicker Needs info
Difficulty 3/5 1-2 days Newbie friendliness 53/100
-
CSS variable stripped from calls to jQuery .css()Possibly taken A pull request linked to this issue is open or already merged. OpenComp: Effects
Difficulty 3/5 1-2 days Newbie friendliness 72/100
-
Needs info
Difficulty 4/5 3-5 days Newbie friendliness 55/100
All issues in jquery/jquery-ui
Similar issues
-
needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
coder/claudecode.nvim#588 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
digitalbazaar/http-client#60 ·
-
Ruby: The link in the Blocks lesson points to an external article that isn't at that address anymoreOpen
Difficulty 1/5 Under an hour Newbie friendliness 84/100
TheOdinProject/curriculum#31529 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
topmonks/hlidac-shopu#3687 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
ONLYOFFICE/DocumentServer#3912 · 1 comment ·