Securing Angular with Trusted Types

on YouTube ↗27m

" summary

Claims that Trusted Types can largely eliminate DOM‑based XSS by rejecting text assignments to dangerous sinks such as innerHTML, requiring a Content‑Security‑Policy header and a trusted types policy to produce a TrustedHTML value. Angular (since v11) emits Trusted Types and still sanitizes innerHTML but bypassSecurityTrustHtml and direct DOM via elementRef/Renderer2 reintroduce risk. Chrome/Chromium support enforcement, Firefox/Safari do not but polyfills help. Google reports ~61% of previously missed XSS are caught; default policies can blunt vulnerable third‑party libs like bootstrap.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 6:16Sanitization
3. 7:45Bypass Security Trust
4. 8:33Leaving the Angular Environment
5. 10:32Trusted Types
6. 18:10Angular Unsafe Bypass
7. 24:32Default Trusted Types Policy

" related talks

• 25mSecuring Angular with Trusted TypesPhilippe De Ryck · NG-DE Conference 2022
• 57mTrusted Types: A World Without XSSGabor Pék, Dávid Schütz · OWASP 2022 Global AppSec Europe Virtual Event
• 36mSecuring the DOM from the Bottom UpMike Samuel, Krzysztof Kotowicz · Node+JS Interactive 2019
• 16mEliminating XSS Angular applications by adopting TTBjarki Agust Gudmundsson · EnterpriseNG 2021
• 31mSecuring the DOM from the Bottom UpKrzysztof Kotowicz · JSNation 2019
• 24mSecurity in Angular 2Martin Probst, Raphaël Jamet · ng-europe 2016
• 17mThere's Safety in AngularAlisa Duncan · ng-conf 2022
• 31mBoosting the security of your Angular 2 applicationPhilippe De Ryck · NG-BE 2016