[Feature Request] Trusted Types support

[tosmolka]

Problem Statement

Not sure if this lib is still actively maintained but some of our apps still depend on it and use it

ReactXP framework should support Trusted Types API so that it can be seamlessly integrated with web applications that enforce Trusted Types for all DOM XSS Injection Sinks (e.g. assignments to Element.innerHTML property) using require-trusted-types-for CSP directive. Trusted Types APIs are now fully supported in web browsers based on Blink engine (Chrome, Edge, Electron and others).

Proposed solution

First we need to identify all instances where ReactXS integrates with such methods and propose re-factoring. We need to be careful to keep supporting web browsers without Trusted Types support and, obviously, mobile platforms (iOS and Android).

We know about these locations so far:

• Assigning empty string into Element.innerHTML
  • We could either use TrustedTypePolicyFactory.emptyHTML or rewrite using assignment to Element.innerText, call to Element.replaceChildren() and so on.

  • reactxp/src/web/CustomScrollbar.ts

    Line 263 in 6b6c56f

    rtlbox.innerHTML = '';

  • reactxp/src/web/CustomScrollbar.ts

    Line 427 in 6b6c56f

    this._verticalBar.rail!.innerHTML = '';

  • reactxp/src/web/CustomScrollbar.ts

    Line 432 in 6b6c56f

    this._horizontalBar.rail!.innerHTML = '';

• Assigning static HTML into Element.innerHTML
  • We could rewrite using standard DOM manipulation functions (Document.createElement, Element.setAttribute(), ...)

  • reactxp/src/web/CustomScrollbar.ts

    Line 249 in 6b6c56f

    rtlbox.innerHTML = '<div class="probe"></div>';

• Assigning dynamic HTML into HTMLIFrameElement.srcdoc
  • This is in extension, we can maybe ignore or pass content through HTML sanitizer such as DOMPurify

  • reactxp/extensions/webview/src/web/WebView.tsx

    Line 101 in 6b6c56f

    (iframeDOM as any).srcdoc = html;

References

• Trusted Types Home
  • Introduction for Web Developer
  • Specification
  • Existing Integrations
  • FAQ
  • ...
• CSP directive require-trusted-types-for