Ensure that HTML assignments are done through TrustedHTML
- Dominant language
- JavaScript
- Stars
- 31.5k
- Forks
- 5.8k
- Avg merge
- 9d 8h
- Merged PRs (30d)
- 2
Description
## Bug Report
When using a content security policy (see policy below), I get an error like this:
```
docsify.js:8535 This document requires 'TrustedHTML' assignment.
_renderTo @ docsify.js:8535
initRender @ docsify.js:8729
Docsify @ docsify.js:9247
(anonymous) @ docsify.js:9277
docsify.js:8535
Uncaught TypeError: Failed to set the 'outerHTML' property on 'Element': This document requires 'TrustedHTML' assignment.
at Docsify._renderTo (docsify.js:8535:53)
at Docsify.initRender (docsify.js:8729:16)
at new Docsify (docsify.js:9247:12)
at HTMLDocument. (docsify.js:9277:39)
```
If I remove the trused type policy from the header I still get this error:
```
docsify.js:8535
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src cdn.jsdelivr.net 'self' ". Either the 'unsafe-inline' keyword, a hash ('sha256-6h52w3SLKvExCLgdk907pJwQu8hZtVM4QMirrrfKGaI='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
```
Line 8535 is an assignment to innerHTML/outerHTML adding a SHA to script tag generated by docsify internals is not possibility.
#### Steps to reproduce
Enable custom response headers on your server. Use the following Content Security Policy:
```
Content-Security-Policy: prefetch-src 'self'; script-src cdn.jsdelivr.net 'self'; style-src cdn.jsdelivr.net 'self'; img-src data: 'self' static.addtoany.com; font-src data: 'self'; manifest-src 'self'; default-src 'none'; base-uri 'self'; frame-ancestors 'none'; trusted-types dompurify; require-trusted-types-for 'script';
```
#### What is current behaviour
Errors as shown above.
#### What is the expected behaviour
Docsify should work normally irrespective of CSP header.
#### Other relevant information
The system information is irrelevant here (I have tested this on Cloudflare pages server, server used is probably more pertinent)
- Your OS:
- Node.js version: 18.8.0
- npm/yarn version:
- Browser version:
- Docsify version: 4.12.2
- Docsify plugins:
#### Please create a reproducible sandbox
I would but I am not sure how to simulate/modify HTTP headers in a sandbox!
Contributor guide
Assessment
This issue has not been assessed yet.