Don't recommend trusted-types if CSP blocks scripts
Open
- Dominant language
- TypeScript
- Stars
- 404
- Forks
- 59
- PR merge metrics
- No merged PRs in 30d
Description
If a CSP has `script-src: none` or equivalent to forbid script loading, or if it has a `sandbox` directive to forbid script execution, the CSP evaluator shouldn't recommend `requires-trusted-types-for: script` because there is no script execution happening in the first place.
Contributor guide
Assessment
This issue has not been assessed yet.