Component: Table may have Trusted Types incompatibilities from .innerHTML assignment #16153
Labels
LTS-PORTABLE
Issue's fix will be ported to supported LTS versions
Type: Bug
Issue contains a bug related to a specific component. Something about the component is not working
Type: Security
Issue contains a security problem or enhancement related to a specific component
Milestone
Describe the bug
When running with Trusted Types enforcement, the
.innerHTML
assignment in table.ts may fail.The values being assigned to
.innerHTML
in this component are all just styles, so we don't need to treat it as markup or use the more dangerous DOM sink assignment.innerHTML
-- as a matter of fact, keeping the assignment as.innerHTML
may hide potential DOM XSS through this callsite. We propose changing this assignment to.textContent
as suggested in https://web.dev/articles/trusted-types#rewrite.Environment
Browsers that are sending the header
Content-Security-Policy: require-trusted-types-for 'script'; ...
Reproducer
No response
Angular version
all
PrimeNG version
all
Build / Runtime
Angular CLI App
Language
TypeScript
Node version (for AoT issues node --version)
all
Browser(s)
Chromium and Chromium based
Steps to reproduce the behavior
No response
Expected behavior
No response
The text was updated successfully, but these errors were encountered: