-
Notifications
You must be signed in to change notification settings - Fork 547
Add default trusted types policy #24455
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR adds a default Trusted Types policy to suppress innerHTML warning messages in browsers, ensuring that static content injected from Docusaurus remains safe and warning-free.
- Added a new JavaScript file that creates a default Trusted Types policy
- Updated the Docusaurus configuration to load the new policy script
Reviewed Changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
File | Description |
---|---|
docs/static/trusted-types-policy.js | Introduces a policy that returns the input string unchanged |
docs/docusaurus.config.ts | Adds script configuration to inject the Trusted Types policy |
Files not reviewed (1)
- docs/static/staticwebapp.config.json: Language not supported
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ok with this as a stepping stone/confirmation that trusted types can be configured this way in our build system. Before closing out the item though IMO we need something a bit stricter.
🔗 No broken links found! ✅ Your attention to detail is admirable. linkcheck output
|
Adding a default Trusted Types policy to prevent warning messages in supported browsers, which were triggered by innerHTML usage in Docusaurus-generated output. Some content is still injected as plain strings even after adding webpack config. By adding a default policy that simply returns the original string, we suppress these warnings without affecting runtime behavior. This is safe because our content is static and known at build time.