Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

insertAdjacentHTML breaks TrustedHTML #30

Open
JingMatrix opened this issue Mar 4, 2023 · 1 comment
Open

insertAdjacentHTML breaks TrustedHTML #30

JingMatrix opened this issue Mar 4, 2023 · 1 comment

Comments

@JingMatrix
Copy link

Please avoid using insertAdjacentHTML function here:

node.insertAdjacentHTML(type, val);

It causes your project Eruda unable to load on websites with Trusted Types API enabled.

@JingMatrix
Copy link
Author

I have a simple workaround to load eruda on pages requiring TrustedTypes.
threads.net is an example website where Trusted Types API is used without checking policy names using CSP.
So in the following workaround, we create a new policy eruda to build TrustedHTML.

https://github.com/JingMatrix/ChromeXt/blob/685f9a07fdb6ca19f24f7e8418e3d178f81bca4d/app/src/main/assets/eruda.js#L5-L19

The above workaround is not perfect, as it didn't cover this usage of innerHTML in luna

https://github.com/liriliri/luna/blob/e1c2374e02f789708461fbb4706e32b9e1de7988/src/dom-highlighter/overlay/tool_highlight.ts#L102

It is better if you to change the source code, so that I don't need to change the js obfuscated codes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant