w3c/trusted-types

View on GitHub

A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.

Stars: 662
Forks: 86
Open beginner issues: 0
Indexed issues: 53

Dominant language: JavaScript
License: No license data
Last GitHub push: Jun 23, 2026
Latest indexed: Sep 20, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed
PR merge metrics: No merged PRs in 30d

Beginner friendly Everything

Open All

53 open issues indexed

Evaluate `createHTML` interaction with sanitizer `replaceWithChildren` (and `runScripts`?) Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/trusted-types#615 · 13 comments · Opened Sep 8, 2026
Define a non-writeable non-configurable own `.toString()` on the `Trusted*` objects Open

Difficulty 3/5 1-2 days Newbie friendliness 65/100

w3c/trusted-types#613 · 2 comments · 1 reaction · Opened Aug 25, 2026
`createHTML` in conjunction with XML documents is a bit broken Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

w3c/trusted-types#612 · 3 reactions · Opened Aug 24, 2026
HTMLScriptElement doesn't show trusted types API in `@webref/idl` Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

w3c/trusted-types#605 · 5 comments · 1 reaction · Opened Feb 7, 2026
Spec text should define how to match against tt-keyword. Open

Difficulty 1/5 Under an hour Newbie friendliness 55/100

w3c/trusted-types#604 · 1 comment · 1 reaction · Opened Jan 9, 2026
Specification Enhancement: Add blob navigation enforcement to Trusted Types Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/trusted-types#599 · Opened Sep 12, 2025
3.5. Process value with a default policy doesn't take into account `default_policy` could be null Open

bug spec

Difficulty 5/5 Over a week Newbie friendliness 30/100

w3c/trusted-types#595 · 5 comments · Opened Aug 13, 2025
Streaming support Open

enhancement future spec

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#594 · 53 comments · 1 reaction · Opened Aug 7, 2025
Duplicate trusted-type policy should invalidate the existing policy too Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#593 · Opened Jul 20, 2025
Deprecate "allow-duplicates" - it's insecure and makes trusted types useless Open

Difficulty 5/5 Over a week Newbie friendliness 28/100

w3c/trusted-types#592 · Opened Jul 20, 2025
Asynchronous createHTML/createScript/createScriptURL Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#588 · 2 comments · Opened Jun 26, 2025
Do non JS scripts really need TT enforcement? Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/trusted-types#586 · 1 comment · Opened May 28, 2025
navigation requests blocked by require-trusted-types-for don't set a violation sample Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

w3c/trusted-types#584 · 3 comments · 1 reaction · Opened Apr 1, 2025
CSP syntax for `require-trusted-types-for` should be forgiving Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#580 · 4 comments · Opened Feb 24, 2025
Clipping of violation’s sample to the 40 first characters Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#577 · 2 comments · Opened Jan 23, 2025
mXSS: should `createHTML` get information about the context? Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/trusted-types#569 · 9 comments · Opened Dec 20, 2024
Rely on WedIDL's "implements" definition for isHTML/isScript/isScriptURL? Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#566 · 5 comments · 1 reaction · Opened Dec 4, 2024
"pre-navigation check" uses "request’s clients's global object" which is null Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

w3c/trusted-types#548 · 1 comment · Opened Sep 18, 2024
"stringifying" in "Process value with a default policy" needs to be defined Open

spec

Difficulty 1/5 Under an hour Newbie friendliness 45/100

w3c/trusted-types#541 · 3 comments · Opened Aug 15, 2024
How can policyValue be 'undefined'? Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#540 · 2 comments · Opened Aug 2, 2024
Should the APIs for creating a TrustedScript etc return a frozen object? Open

spec

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#535 · 1 comment · 1 reaction · Opened Jul 11, 2024
Script element mid-parse protection mechanism Open

spec

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#525 · 10 comments · Opened Jun 12, 2024
getPropertyType and SVGScriptElement href baseVal property Open

spec

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#521 · 3 comments · Opened Jun 12, 2024
Finalise spec mechanism for event handlers Open

spec

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#520 · 14 comments · Opened Jun 12, 2024
Seeking Trusted Types feedback on Array.isTemplateObject Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/trusted-types#519 · 5 comments · 2 reactions · Opened May 28, 2024
Should all 3 script IDL setters change the associated script text value identically Open

spec

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#517 · 11 comments · Opened May 20, 2024
Should SVGScriptElement have an IDL way to set a trusted script value? Open

spec

Difficulty 5/5 Over a week Newbie friendliness 30/100

w3c/trusted-types#512 · 2 comments · Opened May 2, 2024
Script element protection model Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#507 · 2 comments · Opened Apr 22, 2024
`createPolicy`'s permitted policy names are inconsistent with CSP's permitted policy names Open

spec

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#504 · 12 comments · Opened Apr 17, 2024
Check variable naming inside of getAttributeType and getPropertyType methods Open

spec

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

w3c/trusted-types#496 · 2 comments · Opened Mar 28, 2024
[Meta] Upstream changes Open

Difficulty 5/5 Over a week Newbie friendliness 15/100

w3c/trusted-types#476 · 2 comments · Opened Mar 13, 2024
Adopt Infra syntax throughout Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

w3c/trusted-types#472 · 3 reactions · Opened Mar 7, 2024
Developer-centric research results about Trusted Types Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/trusted-types#471 · 2 comments · 1 reaction · Opened Mar 6, 2024
Stringification of TrustedHTML with `null`-data needs to be specified Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#469 · 21 comments · Opened Mar 6, 2024
Creating a policy with policyName="" is possible, but can't be referred to by the "trusted-types" CSP directive Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#466 · 15 comments · Opened Mar 5, 2024
Trusted Types closure to replace fallback policy Open

enhancement future

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#462 · 6 comments · 1 reaction · Opened Feb 29, 2024
Should the polyfill be moved? Open

polyfill

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#444 · Opened Feb 20, 2024
Integration with Shadow Realms? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#442 · 9 comments · Opened Feb 20, 2024
Can lowercasing be removed from getAttributeType()? Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#424 · 5 comments · Opened Jan 25, 2024
Adressing cross-document vectors comprehensively relies on "origin-policy" which is a proposal which is on hold Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/trusted-types#422 · 4 comments · 1 reaction · Opened Jan 25, 2024
Can we add no-op/report? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#421 · 7 comments · 1 reaction · Opened Jan 24, 2024
Create pull request template Open

Difficulty 1/5 Under an hour Newbie friendliness 45/100

w3c/trusted-types#415 · 2 reactions · Opened Jan 23, 2024
Add `fromLiteral` Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/trusted-types#411 · 5 comments · Opened Jan 23, 2024
getAttributeType and getPropertyType should default to HTML namespace, not "" Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

w3c/trusted-types#381 · 4 comments · 1 reaction · Opened Dec 4, 2023
should `null` & `undefined` for sinks requiring TT be a passthrough ? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/trusted-types#379 · 6 comments · Opened May 4, 2023
Can we conditionally enforce Trusted Types based on document response type in XHR? Open

security spec

Difficulty 5/5 Over a week Newbie friendliness 28/100

w3c/trusted-types#360 · 5 comments · Opened Feb 15, 2022
Maybe enforce Trusted Types in XSL's xsl:text Open

future

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#359 · 5 comments · Opened Feb 15, 2022
Maybe enforce Trusted Types in document.createProcessingInstruction? Open

future

Difficulty 4/5 3-5 days Newbie friendliness 38/100

w3c/trusted-types#358 · Opened Feb 15, 2022
Consider allowing `innerHTML = ''` Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/trusted-types#343 · 18 comments · 2 reactions · Opened Jul 7, 2021
Make input argument to createHTML, createScript, and createScriptURL optional Open

future

Difficulty 3/5 1-2 days Newbie friendliness 42/100

w3c/trusted-types#278 · 5 comments · Opened May 5, 2020

w3c/trusted-types

Get new issues in your inbox