josdejong/jsoneditor

Add support for Trusted Types

Open

#1,621 创建于 2024年10月23日

在 GitHub 查看
 (3 评论) (0 反应) (0 负责人)JavaScript (10,781 star) (2,034 fork)batch import
featurehelp wanted

描述

Hello,

I'm using your great library on angular with the @maaxgr/ang-jsoneditor (14.0.0) wrapper & jsoneditor (10.1.0).

I recently started implementing Trusted Types for security reasons and find myself unable to authorize in my CSP the jsoneditor due to a lack of trusted type usage.

image

As it is still experimental I would get it if you want to wait before implementing this, but the polyfill-like approach could be used to mitigate risk if they make breaking changes in the future.

Could you please add support for it ?

Thanks !

贡献者指南

技术栈
javascripthtmlcss
领域
frontendsecurity
议题类型
feature
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
3
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
1-2 days
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
needs maintainer response
清晰度议题是否清楚说明期望改动、验收标准和下一步。
mostly clear
前置要求
Basic JavaScriptUnderstanding of Content Security PolicyFamiliarity with DOM manipulation
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
40
研究方向
Investigate the jsoneditor source code (likely in src/) to identify all locations where dangerous DOM APIs (e.g., innerHTML, insertAdjacentHTML) are used. Create a Trusted Types policy using `trustedTypes.createPolicy` that sanitizes HTML. Modify those code locations to use the policy. Consider using the `trusted types` polyfill for browser compatibility. Refer to MDN documentation on Trusted Types and existing examples in other libraries.