Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: move innerHTML as separate assignment to improve CSP trusted types #1162

Merged
merged 2 commits into from Nov 1, 2023

Conversation

ghiscoding
Copy link
Owner

@ghiscoding ghiscoding commented Oct 30, 2023

  • to further improve CSP support (Content Security Policy), we need to move innerHTML as separate assignment and not use it directly within a createDomElement, so for example this line const elm = createDomElement('div', { innerHTML: '' }) should be split in 2 lines const elm = createDomElement('div'); elm.innerHTML = '';
  • add option RETURN_TRUSTED_TYPE: true to default sanitizer using DOMPurify to improve CSP

TODOs

  • requires new version of SlickGrid v4.x with more CSP fixes

- to further improve CSP support (Content Security Policy), we need to move `innerHTML` as separate assignment and not use it directly within a `createDomElement`, so for example this line `const elm = createDomElement('div', { innerHTML: '' })` should be split in 2 lines `const elm = createDomElement('div'); elm.innerHTML = '';`
@codecov
Copy link

codecov bot commented Oct 30, 2023

Codecov Report

Merging #1162 (9ad28b3) into master (609f88b) will not change coverage.
The diff coverage is 100.00%.

@@            Coverage Diff            @@
##            master     #1162   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          245       245           
  Lines        17166     17181   +15     
  Branches      6196      6197    +1     
=========================================
+ Hits         17166     17181   +15     
Files Coverage Δ
packages/common/src/editors/autocompleterEditor.ts 100.00% <100.00%> (ø)
...ages/common/src/extensions/extensionCommonUtils.ts 100.00% <100.00%> (ø)
packages/common/src/filters/autocompleterFilter.ts 100.00% <100.00%> (ø)
packages/common/src/filters/filterUtilities.ts 100.00% <100.00%> (ø)
packages/common/src/services/domUtilities.ts 100.00% <100.00%> (ø)
...-component/src/slick-composite-editor.component.ts 100.00% <100.00%> (ø)
...tom-footer-component/src/slick-footer.component.ts 100.00% <100.00%> (ø)
...es/custom-tooltip-plugin/src/slickCustomTooltip.ts 100.00% <100.00%> (ø)

@ghiscoding ghiscoding changed the title fix: move innerHTML as separate assignment outside of createDomElement fix: move innerHTML as separate assignment to improve CSP trusted types Oct 30, 2023
@ghiscoding ghiscoding merged commit 9c6a002 into master Nov 1, 2023
5 checks passed
@ghiscoding ghiscoding deleted the bugfix/csp-support branch November 1, 2023 04:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants