use default tt policy to workaround electron webview innerHTML-usage, #…

…113975
microsoft · Jan 7, 2021 · a9dc6d2 · a9dc6d2
1 parent d5fc23c
commit a9dc6d2
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/src/vs/code/electron-browser/workbench/workbench.js b/src/vs/code/electron-browser/workbench/workbench.js
@@ -45,6 +45,22 @@
 		}
 	);
 
+	// add default trustedTypes-policy for logging and to workaround
+	// lib/platform limitations
+	window.trustedTypes?.createPolicy('default', {
+		createHTML(value) {
+			// see https://github.com/electron/electron/issues/27211
+			// Electron webviews use a static innerHTML default value and
+			// that isn't trusted. We use a default policy to check for the
+			// exact value of that innerHTML-string and only allow that.
+			if (value === '<!DOCTYPE html><style type="text/css">:host { display: flex; }</style>') {
+				return value;
+			}
+			// throw new Error('INVALID html usage' + value);
+			console.trace('UNTRUSTED html usage, default trusted types policy should NEVER be reached');
+			return value;
+		}
+	});
 
 	//region Helpers