microsoft / microsoft/AdaptiveCards

[trusted-type] Delay the ttPolicy creation until customer really use it.

Open
#7,921 0 comments 0 reactions 1 assignee View on GitHub

@paulcam206 is already working on this.

Since Sep 26, 2022.

Bug
Dominant language
C#
Stars
2k
Forks
595
Avg merge
1d 19h
Merged PRs (30d)
1

Description

This is a follow up on https://github.com/microsoft/AdaptiveCards/pull/7910#discussion_r975208157

This directive Content-Security-Policy/trusted-types controls what TT policies are allowed in the client.

If the app now consumes new version of AC SDK without changing this directive, all calls to window.trustedTypes.createPolicy will respect trusted-types directive and fail if the policy name is not allowed.

In our code, we are creating TT policies during package load. This means package will trigger CSP violation and fail to load if TT policy is not allowed. It would be better (in my opinion) to create policy when we first use it.

Possible solution:

let ttDeprecatedPolicy = undefined | null | PolicyType

function GetPolicy()
{
    if (ttDeprecatedPolicy === undefined) {
       ttDeprecatedPolicy  = null;
       if (typeof window == ....
   } 
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.