v145 · Web APIs · Security

Trusted Types spec alignment

Chrome 145 aligns the Trusted Types implementation with the latest W3C specification, fixing edge cases in policy enforcement, sink coverage, and error reporting that diverged from the spec.

background

Trusted Types is a browser API that enforces that DOM injection sinks (like innerHTML, eval, and document.write) only receive values approved by a Trusted Types policy, preventing DOM-based XSS. Chrome's implementation has been iteratively aligned with the evolving W3C spec.

Chrome 145 closes several gaps: additional sinks now require Trusted Types when a policy is active, error messages match the spec, and edge cases in policy lookup are fixed.

concepts

  1. Trusted Types Demo

    Creates a Trusted Types policy, creates typed HTML and script URL values, and assigns them to DOM sinks — demonstrating enforcement and error handling.

  2. Policy Reference

    All Trusted Types sink types, which DOM APIs require each type, how to write a policy, and the CSP header required to activate enforcement.

  3. Policy Conflict Tester

    Trigger collision and default-policy scenarios and watch Chrome 145's spec-aligned throws light up where Chrome 144 silently overwrote. Useful before turning enforcement on in a real app.

  4. Sanitizer Bridge

    The canonical real-world Trusted Types pattern: a policy whose createHTML runs a sanitizer. Type HTML, try injecting scripts and event handlers, and watch the threat log show what was stripped before the TrustedHTML value was created.

the change

// Trusted Types (no change to core API — spec alignment fixes)
const policy = trustedTypes.createPolicy('my-policy', {
  createHTML: (input) => {
    // Sanitise input — e.g. with DOMPurify
    return DOMPurify.sanitize(input);
  },
  createScriptURL: (url) => {
    // Allowlist specific origins
    if (new URL(url).origin === 'https://cdn.example') return url;
    throw new Error('Disallowed script URL');
  },
  createScript: (s) => s, // only allow if you trust the source
});

// Assign to sinks:
div.innerHTML = policy.createHTML('<b>safe</b>');
script.src = policy.createScriptURL('https://cdn.example/lib.js');

// Chrome 145 spec alignment:
// - Additional sinks now covered (script.text, etc.)
// - Error type and message matches spec exactly
// - Policy fallback ordering fixed

references