You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[](https://github.com/shgysk8zer0/npm-template/commits/master)
[](https://github.com/AegisJSProject/md-editor/commits/master)
[](https://liberapay.com/shgysk8zer0/donate"Donate using Liberapay")
@@ -27,3 +27,86 @@ A template repo for npm packages
This component utilizes some proposed and experimental APIs including `Element.prototype.setHTML` (this [Sanitizer API](https://github.com/WICG/sanitizer-api))
96
+
and [`String.dedent`](https://github.com/tc39/proposal-string-dedent). These APIs **MUST** be polyfilled. You may find
97
+
the required polyfills in [`@shgysk8zer0/polyfills`](https://npmjs.com/package/@shgysk8zer0/polyfills) or provide your own.
98
+
99
+
## Security
100
+
101
+
Like all `@aegisjsproject` libraries, this component is indended to be safe and compatible in highly secure contexts. It
102
+
is designed to work with a very restricted [CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy)
103
+
as well as [the Trusted Types API](https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API).
104
+
105
+
### Example CSP
106
+
107
+
Note the [SRI](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/SRI) Integrity used
108
+
for a `<script type="importmap">` and the Trusted Types Policy of `aegis-sanitizer#html` (required for the Sanitizer API polyfill).
0 commit comments