Issues

• Evaluate createHTML interaction with sanitizer replaceWithChildren (and runScripts?)

  w3c/trusted-types#615 · Filter by author noamr opened on Sep 8, 2026
  18

• Define a non-writeable non-configurable own .toString() on the Trusted* objects

  w3c/trusted-types#613 · Filter by author nicolo-ribaudo opened on Aug 25, 2026
  2

• createHTML in conjunction with XML documents is a bit broken

  w3c/trusted-types#612 · Filter by author noamr opened on Aug 24, 2026

• HTMLScriptElement doesn't show trusted types API in @webref/idl

  w3c/trusted-types#605 · Filter by author hybrist opened on Feb 7, 2026
  5

• Spec text should define how to match against tt-keyword.

  w3c/trusted-types#604 · Filter by author otherdaniel opened on Jan 9, 2026
  1

• Specification Enhancement: Add blob navigation enforcement to Trusted Types

  w3c/trusted-types#599 · Filter by author reconsumeralization opened on Sep 12, 2025

• 3.5. Process value with a default policy doesn't take into account default_policy could be null

  bugspec
  w3c/trusted-types#595 · Filter by author tete17 opened on Aug 13, 2025
  5

• Streaming support

  enhancementfuturespec
  w3c/trusted-types#594 · Filter by author noamr opened on Aug 7, 2025
  53

• Duplicate trusted-type policy should invalidate the existing policy too

  w3c/trusted-types#593 · Filter by author kkmuffme opened on Jul 20, 2025

• Deprecate "allow-duplicates" - it's insecure and makes trusted types useless

  w3c/trusted-types#592 · Filter by author kkmuffme opened on Jul 20, 2025

• Asynchronous createHTML/createScript/createScriptURL

  w3c/trusted-types#588 · Filter by author fred-wang opened on Jun 26, 2025
  2

• Do non JS scripts really need TT enforcement?

  w3c/trusted-types#586 · Filter by author lukewarlow opened on May 28, 2025
  1

• navigation requests blocked by require-trusted-types-for don't set a violation sample

  w3c/trusted-types#584 · Filter by author fred-wang opened on Apr 1, 2025
  3

• CSP syntax for require-trusted-types-for should be forgiving

  w3c/trusted-types#580 · Filter by author lukewarlow opened on Feb 24, 2025
  4

• Clipping of violation’s sample to the 40 first characters

  w3c/trusted-types#577 · Filter by author fred-wang opened on Jan 23, 2025
  2

• mXSS: should createHTML get information about the context?

  w3c/trusted-types#569 · Filter by author mozfreddyb opened on Dec 20, 2024
  9

• Rely on WedIDL's "implements" definition for isHTML/isScript/isScriptURL?

  w3c/trusted-types#566 · Filter by author fred-wang opened on Dec 4, 2024
  5

• "pre-navigation check" uses "request’s clients's global object" which is null

  w3c/trusted-types#548 · Filter by author ghost opened on Sep 18, 2024 · v1
  1

• "stringifying" in "Process value with a default policy" needs to be defined

  spec
  w3c/trusted-types#541 · Filter by author ghost opened on Aug 15, 2024
  3

• How can policyValue be 'undefined'?

  w3c/trusted-types#540 · Filter by author smaug---- opened on Aug 2, 2024
  2

• Should the APIs for creating a TrustedScript etc return a frozen object?

  spec
  w3c/trusted-types#535 · Filter by author lukewarlow opened on Jul 11, 2024 · v1
  1

• Script element mid-parse protection mechanism

  spec
  w3c/trusted-types#525 · Filter by author lukewarlow opened on Jun 12, 2024 · v1
  10

• getPropertyType and SVGScriptElement href baseVal property

  spec
  w3c/trusted-types#521 · Filter by author lukewarlow opened on Jun 12, 2024
  3

• Finalise spec mechanism for event handlers

  spec
  w3c/trusted-types#520 · Filter by author lukewarlow opened on Jun 12, 2024 · v1
  14

• Seeking Trusted Types feedback on Array.isTemplateObject

  w3c/trusted-types#519 · Filter by author littledan opened on May 28, 2024
  5