Leitfaden für Sicherheitslücken

Häufige Web-Sicherheitslücken verstehen und beheben, die von VitaPulse erkannt werden

Mittel
No Trusted Types Policy

Your site does not use Trusted Types, a browser API that prevents DOM-based cross-site scripting attacks.

Risiko

DOM-based XSS occurs when JavaScript takes user-controlled input and passes it to dangerous DOM sinks (innerHTML, eval, document.write). Without Trusted Types, there is no systematic way to prevent these injection points. Trusted Types enforce that only sanitized, trusted values can be assigned to dangerous DOM properties.

Lösung

Enable Trusted Types via CSP header. Create a Trusted Types policy that sanitizes HTML. Refactor your code to use the policy when assigning to dangerous sinks.

Beispiel
Content-Security-Policy: require-trusted-types-for 'script'
Trusted Types - web.dev MDN - Trusted Types
Kommentare (0)

Noch keine Kommentare. Beginnen Sie die Diskussion!