solidjs / solid / 43492734639

79%

main: 90%

push

github

feat(web): opt-in Trusted Types policy for template, frames and html (#4833)

* feat(web): create templates through a Trusted Types policy

* feat(web): take the Trusted Types policy from the app

* feat(web): parse server HTML through the Trusted Types policy

* feat(web): server no-op setTrustedTypesPolicy; route html tagged-template sinks through the policy

On the server, setTrustedTypesPolicy is a no-op instead of notSup, so an
isomorphic entry that sets a policy does not throw. The server entry also
exports trustedHTML (returns the string) to match the client.

@solidjs/html decodes text and attribute references by assigning to
innerHTML; those three assignments now go through trustedHTML.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117BoWNXgCqM6277GHNWmJX

---------

Co-authored-by: Claude <noreply@anthropic.com>

818 of 1112 branches covered (73.56%)

Branch coverage included in aggregate %.

1143 of 1372 relevant lines covered (83.31%)

30.22 hits per line