Integrations

Here we list the open source projects we know of that already integrate with Trusted Types. We also link to the respective code commits to guide future integrations.

Complete

Project	Version	Policy name	Notes	Links
lit-html	1.3.0	lit-html
Polymer		polymer-html-literal		Issue
Angular	12.1.1	angular, angular#unsafe-bypass, angular#unsafe-jit, angular#bundler		docs, whitepaper
Angular Components		angular#components		PR
webpack	5.37.0	Defined in output.uniqueName	Use output.trustedTypes config option.
DOMPurify	2.0.0	dompurify with optional suffix	Use RETURN_TRUSTED_TYPE config setting	PR
Karma	4.4.0	karma		PR
Karma-jasmine-html-reporter	1.4.2	karma-jasmine-html-reporter		PR
Visual Studio Code / Monaco Editor				Issue
CodeMirror		n/a (no violating code)		PR
FAST		User-created	Pass a policy through DOM.setHTMLPolicy from @microsoft/fast-element	Documentation
safevalues		google#safe
Closure library		goog#html, goog#base, goog#base#devonly#eval	Policy name configurable with --define goog.TRUSTED_TYPES_POLICY_NAME=foo	Commits
Safe Pug templates
emscripten		emscripten#workerPolicy1, emscripten#workerPolicy2, emscripten#workerPolicy3	Use TRUSTED_TYPES=1 setting	PR

• TypeScript type annotations via DefinitelyTyped. Use via npm install --save @types/trusted-types

In progress

• React:

  • React doesn't cause Trusted Types violations.
  • Support for Trusted Types values in dangerouslySetInnerHTML.
  • Support for interpolating Trusted Types values to node attributes. Currently behind enableTrustedTypesIntegration flag (https://github.com/facebook/react/pull/16157), plan to make this behavior the default (https://github.com/facebook/react/pull/19588).

  To compile react with enableTrustedTypesIntegration enabled:

  1. Clone & setup React
  2. enableTrustedTypesIntegration = true in ReactFeatureFlags.js
  3. yarn build react/index,react-dom/index --type=UMD

• jQuery: bug

• VueJS: Pull request

• Next.js: bug

Using Trusted Types in your projects? Let us know!