Senior LevelHTML & Semantic Web
How do you configure DOMPurify and Trusted Types API against DOM-based XSS?
❓ Interview Prompt: Explain DOM-based XSS, DOMPurify configuration (ALLOWED_TAGS, ADD_ATTR), and W3C Trusted Types API policies.
The Trusted Types API locks down dangerous DOM injection sinks (like 'element.innerHTML' or 'eval()'), throwing runtime errors unless assigned a cryptographically safe TrustedHTML object created by a trusted sanitizer policy (DOMPurify).
Code Implementation Example
javascript
// Enforce Trusted Types policy wrapping DOMPurify
if (window.trustedTypes && trustedTypes.createPolicy) {
const policy = trustedTypes.createPolicy('dompurify', {
createHTML: (string) => DOMPurify.sanitize(string)
});
element.innerHTML = policy.createHTML(untrustedString);
}💡Enforcing W3C Trusted Types policy with DOMPurify sanitization.
🎯 Interview Key Takeaway
Use Trusted Types API alongside DOMPurify to eliminate DOM-based XSS injection sinks in modern browsers.
#Trusted Types#DOMPurify#DOM XSS#Security#Senior
Back to all HTML & Semantic Web Questions→