partytown
partytown copied to clipboard
Partytown compatibility with CSP Trusted Types
Describe the bug
I recently tried enabling CSP Trusted Types with a site that uses partytown and it throws errors about TrustedScript
assignment on these specific files
https://github.com/BuilderIO/partytown/blob/0a06db0e2034188a6330d51eb6ab06cce90ecb6d/src/lib/web-worker/worker-exec.ts#L121
https://github.com/BuilderIO/partytown/blob/0a06db0e2034188a6330d51eb6ab06cce90ecb6d/src/lib/web-worker/init-web-worker.ts#L29

I do think to fix this, partytown should ship their own Trusted Type policy and let consumers add the policy via the trusted-types
CSP directive. I'm not a security expert so I'll leave the implementation of custom Trusted Type policy to the ones who can 😅
To Reproduce Steps to reproduce the behavior:
- Add Partytown to a website
- Add CSP rule that enables trusted types
Reproduction link Please include a link to a Stackblitz or Codesandbox reproducing the issue. We will need to see the issue reproduced with hand-written code - we can't debug giant minified third party scripts directly. If you do not include a clean and simple reproduction of your issue, we won't be able to look into it until you do.
Expected behavior It should not complain when running a site with Trusted Types enabled
Partytown version 0.6.4