Trusted Types and The Sanitizer API

[bkardell]

Logistics

• Date & Time: Tuesday 4th June at 15:00 CEST (local time)
• URL: https://meet.jit.si/WEH2024-Trusted-Types
• Notes: https://github.com/Igalia/webengineshackfest/wiki/2024-Trusted-Types-and-The-Sanitizer-API

Facilitator(s)

@bkardell @lukewarlow

Summary

Igalia has been working on Trusted Types. We'll present the state of things for v1, as well as introduce some related topics for v2 discussions:

• unsafe-hashes
• Sanitizer API: current status of discussions and plans around it/imagining ways forward to disable the legacy types that are so problematic.
• new keyword (name TBD) for handling eval() better See 473. It would cause eval() to throw in browsers that support CSP but don't support the new keyword. Its main benefit then is that it blocks random uses of eval() which are not TrustedScript and allows authors to control handles to policies which are more easily reviewed.

Type

Onsite

Other comments

No response

[mrego]

Notes moved to the wiki: https://github.com/Igalia/webengineshackfest/wiki/2024-Trusted-Types-and-The-Sanitizer-API