josdejong/jsoneditor

Add support for Trusted Types

Open

#1,621 建立於 2024年10月23日

在 GitHub 查看
 (3 留言) (0 反應) (0 負責人)JavaScript (10,781 star) (2,034 fork)batch import
featurehelp wanted

描述

Hello,

I'm using your great library on angular with the @maaxgr/ang-jsoneditor (14.0.0) wrapper & jsoneditor (10.1.0).

I recently started implementing Trusted Types for security reasons and find myself unable to authorize in my CSP the jsoneditor due to a lack of trusted type usage.

image

As it is still experimental I would get it if you want to wait before implementing this, but the polyfill-like approach could be used to mitigate risk if they make breaking changes in the future.

Could you please add support for it ?

Thanks !

貢獻者指南

技術棧
javascripthtmlcss
領域
frontendsecurity
議題類型
feature
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-2 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
needs maintainer response
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
mostly clear
前置要求
Basic JavaScriptUnderstanding of Content Security PolicyFamiliarity with DOM manipulation
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
40
研究方向
Investigate the jsoneditor source code (likely in src/) to identify all locations where dangerous DOM APIs (e.g., innerHTML, insertAdjacentHTML) are used. Create a Trusted Types policy using `trustedTypes.createPolicy` that sanitizes HTML. Modify those code locations to use the policy. Consider using the `trusted types` polyfill for browser compatibility. Refer to MDN documentation on Trusted Types and existing examples in other libraries.