René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Medium][security] Trusted Types advertised but never wired into DOM-write sinks","articleBody":"## Severity: 🟡 Medium (false security property + breaks under enforced Trusted Types)\n\n## Location\n[`src/security/trusted-types.ts:63-69`](../blob/main/src/security/trusted-types.ts#L63-L69), [`src/security/sanitize.ts:19-33`](../blob/main/src/security/sanitize.ts#L19-L33) (JSDoc claims \"Uses Trusted Types when available for CSP compliance\"); sinks in [`src/core/dom.ts`](../blob/main/src/core/dom.ts), [`src/view/directives/html.ts:15`](../blob/main/src/view/directives/html.ts#L15), [`src/view/directives/lightweight.ts:42`](../blob/main/src/view/directives/lightweight.ts#L42).\n\n## Description\n`sanitizeHtml` returns a plain **branded string**; `createTrustedHtml`/`getTrustedTypesPolicy` exist but (verified by grep) are **never called by any DOM-write path** — only re-exported. Consequences:\n\n- Under an enforced `require-trusted-types-for 'script'` CSP, every `element.innerHTML = \u003cstring\u003e` / `insertAdjacentHTML(\u003cstring\u003e)` in `dom.ts`/`element.ts`/`collection.ts`/directives **throws**, breaking the framework (fail-closed but non-functional).\n- The documented \"Trusted Types / CSP compliance\" property is absent, which can mislead integrators into assuming a protection layer they do not have.\n\n## Suggested fix\nRoute sink writes through the policy (`createTrustedHtml`) when Trusted Types is supported, falling back to the string path otherwise — so `sanitizeHtml` output actually satisfies an enforced TT policy. Otherwise, correct the documentation to state that TT is not wired into the sinks.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:17.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/171/bQuery/issues/171"}