Support Trusted Types (require-trusted-types-for 'script')
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 5/5
- 預估耗時
- 一週以上
- 新手友好度
- 35/100
- Issue 類型
- 功能
- 描述清晰度
- 需要釐清
- 活躍度
- 活躍
- 技術堆疊
- react, typescript
研究方向
Start with the shared policy helper in #24738 and trace its use from showReportDialog. Then inspect the Replay compression worker, Feedback form, lazyLoadIntegration, loader script, and error-page-embed.js paths named in the report. Done means the affected sinks work under require-trusted-types-for 'script', with the policy and CSP requirements documented.
由索引模型根據 Issue 內容生成。
描述
Problem Statement
Apps that enforce Trusted Types (Content-Security-Policy: require-trusted-types-for 'script') can't use several SDK features without a pass-through default policy, which disables Trusted Types for the whole page.
Repro: https://github.com/oioki/trusted-types-sentry-js-sdk. It's a minimal Vite + React app with @sentry/react 11.0.0 and no Trusted Types policies of its own, so every violation comes from the SDK.
| Sink | Where | Enforced result | Workaround |
|---|---|---|---|
new Worker(url) |
Replay compression worker | Caught; replay continues | useCompression: false (larger payloads) |
innerHTML |
Feedback form (dangerouslySetInnerHTML: logo, success icon, screenshot styles) |
Form doesn't render | showBranding: false covers the logo only |
script.src |
showReportDialog() |
Throws, no dialog | None |
innerHTML |
error-page-embed.js (served by Sentry) |
Blocked once the dialog loads | None |
script.src |
lazyLoadIntegration() |
Throws | None |
script.src |
Loader Script | Throws | None |
The workaround in #15913 (workerUrl) doesn't help: new Worker(url) requires a TrustedScriptURL for any string URL, not just blob: URLs, so a self-hosted worker still violates.
Teams with a strict CSP (enterprise, fintech, public sector, Angular and Lit users) currently have to choose between Sentry's Replay, Feedback and User Feedback dialog and enforcing Trusted Types. Teams in report-only rollout also get SDK noise in their violation reports, with no policy name they can allow.
Solution Brainstorm
- The SDK creates one named policy, e.g.
sentry-sdk, that validates rather than passes values through. It would allow only script URLs the SDK builds itself (DSN host plus the known paths, the CDN) and only static HTML. Apps allow it withtrusted-types sentry-sdk. - Remove the
innerHTMLuses in feedback by building the SVG and styles with DOM APIs. - Document the CSP needed (
trusted-types sentry-sdk, and'allow-duplicates'when more than one SDK copy is on the page).
Additional Context
#24738 is a first step: a shared sentry-sdk policy helper, used by showReportDialog.
Priority
React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it.
- 主要語言
- TypeScript
- 星號
- 8.7k
- 分支
- 1.9k
- 平均合併
- 1 天 15 小時
- 30 天內合併 PR
- 523
環境準備
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
getsentry/sentry-javascript 的其他 Issue
-
Next.js: basePath is concatenated onto absolute router.push hrefs, corrupting navigation transaction names可能已有人在做 @Lms24 於 3 天前認領。 未關閉Browser Bug Next.js Traces
難度 2/5 1-3 小時 新手友好度 75/100
getsentry/sentry-javascript#24672 · 2 則留言 · 已指派 1 人 ·
維護者通常 1 天內回覆
-
javascript
難度 2/5 1-3 小時 新手友好度 75/100
getsentry/sentry-javascript#24200 · 2 則留言 ·
維護者通常 1 天內回覆
-
javascript Task
難度 2/5 1-3 小時 新手友好度 82/100
getsentry/sentry-javascript#24134 · 1 則留言 ·
維護者通常 1 天內回覆
-
Cloudflare Workers javascript Tests
難度 2/5 1-3 小時 新手友好度 78/100
getsentry/sentry-javascript#24051 · 1 則留言 ·
維護者通常 1 天內回覆
-
Bug Bun javascript
難度 2/5 1-3 小時 新手友好度 92/100
getsentry/sentry-javascript#24045 · 1 則留言 ·
維護者通常 1 天內回覆
查看 getsentry/sentry-javascript 的全部 Issue
相似的 Issue
-
bug
難度 1/5 1 小時以內 新手友好度 88/100
StabilityNexus/Fate-EVM-Frontend#153 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 78/100
code-yeongyu/oh-my-openagent#9039 ·
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 84/100
Tencent/teamai-cli#862 ·
維護者通常 1 天內回覆
-
bug good first issue hacktoberfest redis
難度 2/5 1-3 小時 新手友好度 88/100
libredb/libredb-studio#1164 ·
維護者通常 1 天內回覆
-
flake
難度 2/5 1-3 小時 新手友好度 85/100
維護者通常 1 天內回覆