Skip to content

Add default trusted types policy #24455

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Apr 25, 2025
Merged

Add default trusted types policy #24455

merged 8 commits into from
Apr 25, 2025

Conversation

dannimad
Copy link
Contributor

Adding a default Trusted Types policy to prevent warning messages in supported browsers, which were triggered by innerHTML usage in Docusaurus-generated output. Some content is still injected as plain strings even after adding webpack config. By adding a default policy that simply returns the original string, we suppress these warnings without affecting runtime behavior. This is safe because our content is static and known at build time.

@Copilot Copilot AI review requested due to automatic review settings April 24, 2025 22:24
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a default Trusted Types policy to suppress innerHTML warning messages in browsers, ensuring that static content injected from Docusaurus remains safe and warning-free.

  • Added a new JavaScript file that creates a default Trusted Types policy
  • Updated the Docusaurus configuration to load the new policy script

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File Description
docs/static/trusted-types-policy.js Introduces a policy that returns the input string unchanged
docs/docusaurus.config.ts Adds script configuration to inject the Trusted Types policy
Files not reviewed (1)
  • docs/static/staticwebapp.config.json: Language not supported

@github-actions github-actions bot added area: website base: main PRs targeted against main branch labels Apr 24, 2025
Copy link
Contributor

@Abe27342 Abe27342 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok with this as a stepping stone/confirmation that trusted types can be configured this way in our build system. Before closing out the item though IMO we need something a bit stricter.

Copy link
Contributor

🔗 No broken links found! ✅

Your attention to detail is admirable.

linkcheck output


> fluid-framework-docs-site@0.0.0 ci:check-links /home/runner/work/FluidFramework/FluidFramework/docs
> start-server-and-test "npm run serve -- --no-open" 3000 check-links

1: starting server using command "npm run serve -- --no-open"
and when url "[ 'http://127.0.0.1:3000' ]" is responding with HTTP status code 200
running tests using command "npm run check-links"


> fluid-framework-docs-site@0.0.0 serve
> docusaurus serve --no-open

[SUCCESS] Serving "build" directory at: http://localhost:3000/

> fluid-framework-docs-site@0.0.0 check-links
> linkcheck http://localhost:3000 --skip-file skipped-urls.txt

Crawling...

Stats:
  164989 links
    1316 destination URLs
    1547 URLs ignored
       0 warnings
       0 errors


@dannimad dannimad enabled auto-merge (squash) April 25, 2025 21:09
@dannimad dannimad merged commit 64c4683 into main Apr 25, 2025
53 checks passed
@dannimad dannimad deleted the default-ttm branch April 25, 2025 21:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: website base: main PRs targeted against main branch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants