Conversation

I didn't realize trusted-types: 'none' could be added to explicitly forbid creating Trusted Types policies. twitter.com/shhnjk/status/ Added it to the global policy for attestation.app and grapheneos.org in addition to baseline require-trusted-types-for 'script'.

Quote Tweet

Jun Kokatsu

@shhnjk

Mar 26, 2021

The story about how we killed XSS from Edge internal pages

microsoftedge.github.io/edgevr/posts/e

Daniel Micay

@DanielMicay

Mar 26, 2021

The zip library used for the web installer doesn't support Trusted Types yet so we're not using it for the grapheneos.org/install/web page yet. Something to do with the way the zip library (github.com/nodeca/pako) uses web workers. Don't have resources to improve that for them...

grapheneos.org

GrapheneOS web installer

Web-based installer for GrapheneOS, a security and privacy focused mobile OS with Android app compatibility.

Daniel Micay

@DanielMicay

github.com/gildas-lormeau uses that lower-level DEFLATE library via web workers. The way it's being done is dynamic and results in a Trusted Types violation. It'd ideally be changed to work without needing a Trusted Types policy. Don't have time to look into it but someone could.

github.com

GitHub - gildas-lormeau/zip.js: JavaScript library to zip and unzip files supporting multi-core...

JavaScript library to zip and unzip files supporting multi-core compression, compression streams, Zip64 and encryption. - GitHub - gildas-lormeau/zip.js: JavaScript library to zip and unzip files s...

5:25 PM · Mar 27, 2021Twitter Web App

Likes