fix: use Trusted Types to assign innerHTML in WebviewImpl

This makes the webview compliant with clients that enforce Trusted Types. See https://web.dev/trusted-types. Fixes electron#27211.
koto · Jan 8, 2021 · 02d0fd0 · Siegrift · Jan 8, 2021 · 02d0fd0
1 parent 9aef11a
commit 02d0fd0
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/lib/renderer/web-view/web-view-impl.ts b/lib/renderer/web-view/web-view-impl.ts
@@ -44,7 +44,14 @@ export class WebViewImpl {
     // Create internal iframe element.
     this.internalElement = this.createInternalElement();
     const shadowRoot = this.webviewNode.attachShadow({ mode: 'open' });
-    shadowRoot.innerHTML = '<!DOCTYPE html><style type="text/css">:host { display: flex; }</style>';
+    // Assign to innerHTML using Trusted Types if available,
+    // for hosts that enforce Trusted Types.
+    const view = this.webviewNode.ownerDocument.defaultView;
+    const webviewHTML = '<!DOCTYPE html><style type="text/css">:host { display: flex; }</style>';
+    const ttPolicy = view?.trustedTypes?.createPolicy('electron', { createHTML: (s) => s });
+    const html = ttPolicy?.createHTML(webviewHTML) ?? webviewHTML;
+    shadowRoot.innerHTML = html as string;
+
     this.setupWebViewAttributes();
     this.viewInstanceId = getNextId();
     shadowRoot.appendChild(this.internalElement);

diff --git a/package.json b/package.json
@@ -24,6 +24,7 @@
     "@types/send": "^0.14.5",
     "@types/split": "^1.0.0",
     "@types/stream-json": "^1.5.1",
+    "@types/trusted-types": "^2.0.0",
     "@types/uuid": "^3.4.6",
     "@types/webpack": "^4.41.21",
     "@types/webpack-env": "^1.15.2",