Post

704: Sanitizer API with Frederik Braun We talk with Frederik Braun from Mozilla about the Sanitizer API, how it works with HTML tags and web components, what it does with malformed HTML, and where CSP fits in alongside the Sanitizer API.

shoptalkshow.com704: Sanitizer API with Frederik BraunWe talk with Frederik Braun from Mozilla about the Sanitizer API, how it works with HTML tags and web components, what it does with malformed HTML, and where CSP fits in alongside the Sanitizer API.

Luke

@lukewarlow.dev

The CSP to disable unsafe sinks is `require-trusted-types-for 'script'; trusted-types 'none';`. This enables trusted types enforcement and that no policy names are allowed. So you're forced to use setHTML for setting HTML, it then also blocks eval and other forms of dynamic JavaScript execution.

3/3/26, 1:29 pm0 reposts0 likes

Luke

@lukewarlow.dev

3 Mar

Though worth being aware that in browsers without setHTML this will mean you can't set HTML at all.