Skip to content

Improve 'trusted-create-element' — add 'trusted-types' policy #507

@AdamWr

Description

@AdamWr

Similar to #457 but about trusted-create-element.

Steps to reproduce:

  1. Add this rule:
youtube.com#%#//scriptlet('trusted-create-element', 'head', 'script', '', 'alert(1)')
  1. Go to - https://www.youtube.com/

Alert message should be displayed but adding a script is blocked by Trusted Types.

Screenshot

Image

Adding trustedTypes.createPolicy to scriptlet probably should fixes it.

Issue occurs in Chromium based browsers but doesn't occur in Firefox because it doesn't support Trusted Types API.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions