-
Notifications
You must be signed in to change notification settings - Fork 594
[JS] Implement Trusted Types #7819
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
paulcam206
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This change also needs to be tested -- please let me know how that's being done...
paulcam206
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
changes look good -- how did you test?
I did manual testing, and the designer looks good. |
Add this line to head of html and use the https link <meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';" /> |
paulcam206
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
one last thing 😃
This reverts commit 4cfd284.
| return false; | ||
| } | ||
|
|
||
| // Markdown processing is handled outside of Adaptive Cards. It's up to the host to ensure that markdown is safely |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@licanhua , if you are shifting responsibility for markdown HTML sanitization outside of AC SDK, can you change onProcessMarkdown callback so that host can return TrustedHTML instead of string and then AC SDK will pass-through the value to innerHTML setter without converting to string?
This way the host will indeed be responsible (will have to deal with Trusted Types) and AC SDK will not blindly mark as Trusted data that is outside of its control.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@paulcam206 and @dclaux, any concern for me to change to signature of onProcessMarkdown to TrustedHTML?
* [JS] Implement Trusted Types Fixes microsoft#6692 * use trustedHtml for innerHtml= * fix build error on calendar.ts * revert change on tsconfig * revert change on adaptivecards-designer and use emptyhtml * use emptyHTML * remove setInnerHtml for adaptivecards-controls * apply policy to adaptivecards-designer * Revert "apply policy to adaptivecards-designer" This reverts commit 4cfd284. Co-authored-by: Paul Campbell <paulcam@microsoft.com>


Fixes #6692
Trusted when arbitrary HTML assignments into .innerHTML
code examples
TT docs: https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API
A Guide to TT: https://web.dev/trusted-types/
TT w3c spec: https://w3c.github.io/webappsec-trusted-types/dist/spec/
Microsoft Reviewers: Open in CodeFlow