Why assigning Trusted Types to dangerous sinks still causes compilation error? about tsec HOT 5 CLOSED

Because parseFromString itself doesn't return a Trusted Type. It returns a DOM node.

Could you describe your use case with more details?

from tsec.

Because parseFromString itself doesn't return a Trusted Type. It returns a DOM node.

Well, I'm talking about difference in behavior.
Why is assigning TrustedHTML to innerHTML doesn't require ban-element-innerhtml-assignments exemption but it does require ban-domparser-parsefromstring exemption on parseFromString?

from tsec.

Because we believe such cases are extremely rare, and analysis regarding function properties is less precise in general. If you have a strong use case for parseFromString to consume a Trusted Types value, we can consider supporting it.

from tsec.

We are just parsing XML file uploaded by user.

But in that case, can you at least document which sinks won't require exemption when used with Trusted Types? Maybe add a column of Skips exemption with Trusted Types with Boolean value here?

from tsec.

Yes, I will update the doc.

from tsec.