Meziantou.FrameworkTrustedTypesDirectives Class
The Trusted Types directives of a content security policy (https://w3c.github.io/trusted-types/dist/spec/#integration-with-content-security-policy): require-trusted-types-for and trusted-types. Trusted Types are enforced for the documents whose Document.TrustedTypesDirectives contain directives (there are none by default).
public sealed class TrustedTypesDirectivesRemarks
The violations are reported as violations of the content security policy of the directives: the securitypolicyviolation event and the report-uri reports of the policy delivered with the document (a Content-Security-Policy header or a meta element).
Constructors
| Name | Description |
|---|---|
| TrustedTypesDirectives() |
TrustedTypesDirectives()
public TrustedTypesDirectives()No documentation is available.
Properties
| Name | Description |
|---|---|
| ReportOnly | Whether the disposition of the policy is "report" (Content-Security-Policy-Report-Only): the directives do not block anything, but the default policy is still applied to the values of the sinks. |
| RequireTrustedTypesForScript | Whether the policy contains the require-trusted-types-for 'script' directive (https://w3c.github.io/trusted-types/dist/spec/#require-trusted-types-for-csp-directive): the DOM XSS injection sinks only accept trusted types (or the values of the default policy). |
| TrustedTypes | The value of the trusted-types directive (https://w3c.github.io/trusted-types/dist/spec/#trusted-types-csp-directive): the policy names that can be created, * (any name), 'allow-duplicates' and 'none'. null when the policy has no trusted-types directive (any policy can be created). |
ReportOnly
TrustedTypesDirectives.csRequireTrustedTypesForScript
TrustedTypesDirectives.csWhether the policy contains the require-trusted-types-for 'script' directive (https://w3c.github.io/trusted-types/dist/spec/#require-trusted-types-for-csp-directive): the DOM XSS injection sinks only accept trusted types (or the values of the default policy).
public bool RequireTrustedTypesForScript { get; init; }Property value
TrustedTypes
TrustedTypesDirectives.csThe value of the trusted-types directive (https://w3c.github.io/trusted-types/dist/spec/#trusted-types-csp-directive): the policy names that can be created, * (any name), 'allow-duplicates' and 'none'. null when the policy has no trusted-types directive (any policy can be created).
public IReadOnlyList<string>? TrustedTypes { get; init; }Property value
Methods
| Name | Description |
|---|---|
| Parse(string, bool) | Returns the Trusted Types directives of a serialized content security policy (e.g. the value of a Content-Security-Policy header, https://w3c.github.io/webappsec-csp/#parse-serialized-policy). The other directives are ignored. |
Parse(string, bool)
TrustedTypesDirectives.csReturns the Trusted Types directives of a serialized content security policy (e.g. the value of a Content-Security-Policy header, https://w3c.github.io/webappsec-csp/#parse-serialized-policy). The other directives are ignored.
public static TrustedTypesDirectives Parse(string serializedPolicy, bool reportOnly = false)