diff --git a/lib/renderer/web-view/web-view-impl.ts b/lib/renderer/web-view/web-view-impl.ts index c345d7a4de9af..7e8a4937daa91 100644 --- a/lib/renderer/web-view/web-view-impl.ts +++ b/lib/renderer/web-view/web-view-impl.ts @@ -44,7 +44,14 @@ export class WebViewImpl { // Create internal iframe element. this.internalElement = this.createInternalElement(); const shadowRoot = this.webviewNode.attachShadow({ mode: 'open' }); - shadowRoot.innerHTML = ''; + // Assign to innerHTML using Trusted Types if available, + // for hosts that enforce Trusted Types. + const view = this.webviewNode.ownerDocument.defaultView; + const webviewHTML = ''; + const ttPolicy = view?.trustedTypes?.createPolicy('electron', { createHTML: (s) => s }); + const html = ttPolicy?.createHTML(webviewHTML) ?? webviewHTML; + shadowRoot.innerHTML = html as string; + this.setupWebViewAttributes(); this.viewInstanceId = getNextId(); shadowRoot.appendChild(this.internalElement); diff --git a/package.json b/package.json index f43aa777f03d7..2c1d6e78aa69e 100644 --- a/package.json +++ b/package.json @@ -24,6 +24,7 @@ "@types/send": "^0.14.5", "@types/split": "^1.0.0", "@types/stream-json": "^1.5.1", + "@types/trusted-types": "^2.0.0", "@types/uuid": "^3.4.6", "@types/webpack": "^4.41.21", "@types/webpack-env": "^1.15.2",