Integrations

Here we list the open source projects we know of that already integrate with Trusted Types. We also link to the respective code commits to guide future integrations.

Complete

• lit-html: Supported in 1.3.0. Uses lit-html as a policy name.
• Polymer: Issue
• Angular: Support launched in version 12.1.1 - docs.
• webpack: Supported in Webpack 5 - use output.trustedTypes config option.
• DOMPurify: Supported in 2.0.0 - Pull request. Use RETURN_TRUSTED_TYPE config setting.
• Karma: Supported in 4.4.0 - Pull request
• Karma-jasmine-html-reporter: PR
• Visual Studio Code: bug
• FAST: Use DOM.setHTMLPolicy from @microsoft/fast-element - documentation
• Closure library: Compile with --define goog.TRUSTED_TYPES_POLICY_NAME=myPolicyName to enable the support. Commits
• Safe Pug templates
• TypeScript type annotations via DefinitelyTyped. Use via npm install --save @types/trusted-types

In progress

• React:

  • React doesn't cause Trusted Types violations.
  • Support for Trusted Types values in dangerouslySetInnerHTML.
  • Support for interpolating Trusted Types values to node attributes. Currently behind enableTrustedTypesIntegration flag (https://github.com/facebook/react/pull/16157), plan to make this behavior the default (https://github.com/facebook/react/pull/19588).

  To compile react with enableTrustedTypesIntegration enabled:

  1. Clone & setup React
  2. enableTrustedTypesIntegration = true in ReactFeatureFlags.js
  3. yarn build react/index,react-dom/index --type=UMD

• jQuery: bug

• VueJS: Pull request

• Next.js: bug

Using Trusted Types in your projects? Let us know!