René's URL Explorer Experiment

Title: fix(security): wire Trusted Types into the framework's HTML sinks by JosunLP · Pull Request #191 · bQuery/bQuery · GitHub

Open Graph Title: fix(security): wire Trusted Types into the framework's HTML sinks by JosunLP · Pull Request #191 · bQuery/bQuery

X Title: fix(security): wire Trusted Types into the framework's HTML sinks by JosunLP · Pull Request #191 · bQuery/bQuery

Description: Summary Fixes #171 (Medium). createTrustedHtml / getTrustedTypesPolicy existed but no DOM-write path called them — they were only re-exported. So under an enforced require-trusted-types-for 'script' CSP, every innerHTML =/insertAdjacentHTML in dom.ts/collection.ts/element.ts/directives threw (framework fails closed but non-functional), and the documented "Trusted Types / CSP compliance" property was simply absent. Fix New trustedHtmlForSink(rawHtml) in security/trusted-types.ts: returns a TrustedHTML when a policy is active (so the write satisfies enforced TT), otherwise the sanitized string — sanitizing exactly once. All sanitized sinks now route through it: core/dom.ts: setHtml, createElementFromHtml, insertContent core/collection.ts: Collection.html(), insertAll() view/directives: bq-html (sanitized branch), bq-html-safe element.ts html() inherits it via setHtml The explicit htmlUnsafe() / sanitize: false escape hatches are deliberately left as raw writes (bypassing sanitization is their documented purpose). The sanitizeHtml JSDoc is corrected to describe actual behavior (returns a branded string; the framework's sinks wrap it for TT). Verification New test proves the positive path: with a mock TT policy installed (fresh module instance to avoid cached-policy leakage), trustedHtmlForSink invokes policy.createHTML and returns the branded TrustedHTML. New test for the fallback path: returns a sanitized, sink-safe string in a non-TT environment. Existing sink sanitization tests still pass (behavior unchanged without TT). Full suite: 2988 pass / 0 fail. tsc --noEmit + eslint clean. 🤖 Generated with Claude Code

Open Graph Description: Summary Fixes #171 (Medium). createTrustedHtml / getTrustedTypesPolicy existed but no DOM-write path called them — they were only re-exported. So under an enforced require-trusted-types-for 'sc...

X Description: Summary Fixes #171 (Medium). createTrustedHtml / getTrustedTypesPolicy existed but no DOM-write path called them — they were only re-exported. So under an enforced require-trusted-types-for &#3...

Opengraph URL: https://github.com/bQuery/bQuery/pull/191

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width