ENABLING TRUSTED TYPES IN A COMPLEX WEB APPLICATION: A CASE STUDY OF APPSHEET

Summary from the TLDR InfoSec newsletter

Trusted Types is a defense-in-depth mechanism that protects against DOM XSS by implementing type systems to ensure that only safely constructed values can reach injection sinks. To rollout Trusted Types in AppSheet, the Google team followed a five stage process: report-only mode, collect and triage violations, refactor blockers, repeat the previous two steps, and enforcement. When investigating a Trusted Types violation, a report contains the source file where the violation occurred, the document URI which is the URI where the violation occurred, and the script-sample which includes the underlying API call that caused the violation and a prefix of the input that caused the violation.