TrustedTypePolicy

The TrustedTypePolicy interface of the Trusted Types API defines a group of functions which create TrustedType objects.

A TrustedTypePolicy object is created by TrustedTypePolicyFactory.createPolicy() to define a policy for enforcing security rules on input. Therefore, TrustedTypePolicy has no constructor.

Properties

TrustedTypePolicy.nameRead only

A DOMString containing the name of the policy.

Methods

TrustedTypePolicy.createHTML()

Creates a TrustedHTML object.

TrustedTypePolicy.createScript()

Creates a TrustedScript object.

TrustedTypePolicy.createScriptURL()

Creates a TrustedScriptURL object.

Examples

In the below example we create a policy that will create TrustedHTML objects using TrustedTypePolicyFactory.createPolicy(). We can then use TrustedTypePolicy.createHTML to create a sanitized HTML string to be inserted into the document.

The sanitized value can then be used with Element.innerHTML to ensure that no new HTML elements can be injected.

<div id="myDiv"></div>
const escapeHTMLPolicy = trustedTypes.createPolicy("myEscapePolicy", {
  createHTML: (string) => string.replace(/\>/g, "<")
});

let el = document.getElementById("myDiv");
const escaped = escapeHTMLPolicy.createHTML("<img src=x onerror=alert(1)>");
console.log(escaped instanceof TrustedHTML); // true
el.innerHTML = escaped;

Specifications

Browser compatibility

Desktop Mobile
Chrome Edge Firefox Internet Explorer Opera Safari WebView Android Chrome Android Firefox for Android Opera Android Safari on IOS Samsung Internet
TrustedTypePolicy
83
83
No
No
69
No
83
83
No
59
No
13.0
createHTML
83
83
No
No
69
No
83
83
No
59
No
13.0
createScript
83
83
No
No
69
No
83
83
No
59
No
13.0
createScriptURL
83
83
No
No
69
No
83
83
No
59
No
13.0
name
83
83
No
No
69
No
83
83
No
59
No
13.0

© 2005–2021 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/API/TrustedTypePolicy