Trusted Types Support

[kekizz]

Hello!

I would like to request trusted types support for the package.

Specifically, we need to be able to pass a policy instance and for this instance to be used in every Worker constructor.

As of today, there is only one Worker constructor that needs the policy which is in the worker-timers-broker dependency, module.ts file, line 12.

I understand we can achieve this by using the dependencies directly, but for the sake of convenience it would be great if we can add it here.

For example, in load-or-return-broker.ts:

Before
broker = loadBroker(url)

After

...
if (trustedTypesPolicyInstance) {
   const trustedUrl = trustedTypesPolicyInstance.createScriptURL(url);
   broker = loadBroker(trustedUrl)
}
...

Thanks

[chrisguttandin]

Hi @kekizz,

I have limited experience with Trusted Types so far so the following might be wrong. But as far as I understand it your snippet from above would need to mark the Blob used by worker-timers as trusted. So my guess is that the policy would look somehow like this:

trustedTypes.createPolicy(
    'worker-timers-policy',
    { createScriptURL: (url) => url.startsWith('blob:') }
);

If you make the check any stricter it might break with every update of the worker-timers package. But if you only check for the 'blob:' prefix I wonder how this would prevent an attacker from creating arbitrary code.

Again, there is a good chance I'm missing something obvious here.

By the way I've add a usage section to the worker-timers-broker README.

Wouldn't it be better from a security standpoint to bundle all the code yourself? You could then point to static assets instead of dealing with inlined code in a Blob.