element-hq / element-hq/element-web
require-trusted-types-for 'script'; trusted-types 'none'
Open
T-Enhancement
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
#### Is your suggestion related to a problem? Please describe.
Element uses unsafe DOM manipulation which poses a risk of cross-site scripting and other attacks.
#### Describe the solution you'd like.
Remove the unsafe DOM manipulation and set `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types 'none'`
#### Describe alternatives you've considered.
None
#### Additional context
Contributor guide
Assessment
This issue has not been assessed yet.