Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

Support Trusted Types (require-trusted-types-for 'script')

Aberta
  • Algo errado?
#24,744 1 comentário 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
35/100
Tipo de issue
Funcionalidade
Clareza
Precisa de esclarecimento
Status de atividade
Ativa
Stack de tecnologia
react, typescript
Domínio
frontend, security

Direção de pesquisa

Start with the shared policy helper in #24738 and trace its use from showReportDialog. Then inspect the Replay compression worker, Feedback form, lazyLoadIntegration, loader script, and error-page-embed.js paths named in the report. Done means the affected sinks work under require-trusted-types-for 'script', with the policy and CSP requirements documented.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Feature
Problem Statement

Apps that enforce Trusted Types (Content-Security-Policy: require-trusted-types-for 'script') can't use several SDK features without a pass-through default policy, which disables Trusted Types for the whole page.

Repro: https://github.com/oioki/trusted-types-sentry-js-sdk. It's a minimal Vite + React app with @sentry/react 11.0.0 and no Trusted Types policies of its own, so every violation comes from the SDK.

Sink Where Enforced result Workaround
new Worker(url) Replay compression worker Caught; replay continues useCompression: false (larger payloads)
innerHTML Feedback form (dangerouslySetInnerHTML: logo, success icon, screenshot styles) Form doesn't render showBranding: false covers the logo only
script.src showReportDialog() Throws, no dialog None
innerHTML error-page-embed.js (served by Sentry) Blocked once the dialog loads None
script.src lazyLoadIntegration() Throws None
script.src Loader Script Throws None

The workaround in #15913 (workerUrl) doesn't help: new Worker(url) requires a TrustedScriptURL for any string URL, not just blob: URLs, so a self-hosted worker still violates.

Teams with a strict CSP (enterprise, fintech, public sector, Angular and Lit users) currently have to choose between Sentry's Replay, Feedback and User Feedback dialog and enforcing Trusted Types. Teams in report-only rollout also get SDK noise in their violation reports, with no policy name they can allow.

Solution Brainstorm
  • The SDK creates one named policy, e.g. sentry-sdk, that validates rather than passes values through. It would allow only script URLs the SDK builds itself (DSN host plus the known paths, the CDN) and only static HTML. Apps allow it with trusted-types sentry-sdk.
  • Remove the innerHTML uses in feedback by building the SVG and styles with DOM APIs.
  • Document the CSP needed (trusted-types sentry-sdk, and 'allow-duplicates' when more than one SDK copy is on the page).
Additional Context

#24738 is a first step: a shared sentry-sdk policy helper, used by showReportDialog.

Priority

React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it.

Linguagem predominante
TypeScript
Estrelas
8.7k
Forks
1.9k
Merge médio
1d 15h
PRs com merge (30d)
523

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de getsentry/sentry-javascript

Todas as issues de getsentry/sentry-javascript

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.