Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

Medium

No Trusted Types Policy

Your site does not use Trusted Types, a browser API that prevents DOM-based cross-site scripting attacks.

Risk

DOM-based XSS occurs when JavaScript takes user-controlled input and passes it to dangerous DOM sinks (innerHTML, eval, document.write). Without Trusted Types, there is no systematic way to prevent these injection points. Trusted Types enforce that only sanitized, trusted values can be assigned to dangerous DOM properties.

Solution

Enable Trusted Types via CSP header. Create a Trusted Types policy that sanitizes HTML. Refactor your code to use the policy when assigning to dangerous sinks.

Example

Content-Security-Policy: require-trusted-types-for 'script'

Trusted Types - web.dev MDN - Trusted Types

Comments (0)

No messages yet.