Post

704: Sanitizer API with Frederik Braun We talk with Frederik Braun from Mozilla about the Sanitizer API, how it works with HTML tags and web components, what it does with malformed HTML, and where CSP fits in alongside the Sanitizer API.

The CSP to disable unsafe sinks is `require-trusted-types-for 'script'; trusted-types 'none';`. This enables trusted types enforcement and that no policy names are allowed. So you're forced to use setHTML for setting HTML, it then also blocks eval and other forms of dynamic JavaScript execution.