CS Fundamentals Trainer · JavaScript · Security

A page is served with Content-Security-Policy: require-trusted-types-for 'script' and creates no Trusted Types policy. What happens when…

A page is served with `Content-Security-Policy: require-trusted-types-for 'script'` and creates no Trusted Types policy. What happens when it runs `el.innerHTML = '<b>hi</b>'` in Chromium?

  1. The string is sanitised automatically: the `<b>` stays in place and any scripts or handlers are removed.
  2. The assignment throws a `TypeError`, because the sink now requires a `TrustedHTML` object instead of a string.
  3. The assignment succeeds and logs a console warning, because the directive runs in report mode by default.
  4. The markup is inserted as plain text, exactly as if `textContent` had been used instead.

Difficulty: hard

Answer this question

Related questions