[flags] land enableTrustedTypesIntegration

[everettbu]

Mirror of facebook/react#35816
Original author: rickhanlonii

---

Summary

This flag enables React's integration with the browser Trusted Types API.

The Trusted Types API is a browser security feature that helps prevent DOM-based XSS attacks. When a site enables Trusted Types enforcement via Content-Security-Policy: require-trusted-types-for 'script', the browser requires that values passed to DOM injection sinks (like innerHTML) are typed objects (TrustedHTML, TrustedScript, TrustedScriptURL) created through developer-defined sanitization policies, rather than raw strings.

What changed

Previously, React always coerced values to strings (via '' + value) before passing them to DOM APIs like setAttribute and innerHTML. This broke Trusted Types because it converted typed objects into plain strings, which the browser would then reject under Trusted Types enforcement.

React now passes values directly to DOM APIs without string coercion, preserving Trusted Types objects so the browser can validate them. This applies to dangerouslySetInnerHTML, all HTML and SVG attributes, and URL attributes (href, action, etc).

Before (broken)

Using Trusted Types with something likedangerouslySetInnerHTML would throw:

const sanitizer = trustedTypes.createPolicy('sanitizer', {
  createHTML: (input) => DOMPurify.sanitize(input),
});

function Comment({text}) {
  const clean = sanitizer.createHTML(text);
  // clean is a TrustedHTML object, but React would call '' + clean,
  // converting it back to a plain string before setting innerHTML.
  // Under Trusted Types enforcement, the browser rejects the string:
  //
  //   TypeError: Failed to set 'innerHTML' on 'Element':
  //   This document requires 'TrustedHTML' assignment.
  return <div dangerouslySetInnerHTML={{__html: clean}} />;
}

After (works)

React now passes the TrustedHTML object directly to the DOM without stringifying it:

 const policy = trustedTypes.createPolicy('sanitizer', {
   createHTML: (input) => DOMPurify.sanitize(input),
 });

 function Comment({text}) {
   // TrustedHTML objects are passed directly to innerHTML
   return <div dangerouslySetInnerHTML={{__html: policy.createHTML(text)}} />;
 }

 function UserProfile({bio}) {
   // String attribute values also preserve Trusted Types objects
   return <div data-bio={policy.createHTML(bio)} />;
 }

Non-breaking change

• Sites using Trusted Types: React no longer breaks Trusted Types enforcement. TrustedHTML and TrustedScriptURL objects passed through React props are forwarded to the DOM without being stringified.
• Sites not using Trusted Types: No behavior change. DOM APIs accept both strings and Trusted Types objects, so removing the explicit string coercion is functionally identical.

[greptile-apps]

Greptile Summary

This PR permanently enables the enableTrustedTypesIntegration feature flag across all React build configurations (OSS, www, native FB, native OSS, and all test renderers). The flag was previously set to false everywhere (or __VARIANT__ in www-dynamic for A/B testing).

• All 6 fork files flip enableTrustedTypesIntegration from false to true
• ReactFeatureFlags.www-dynamic.js removes the flag from the GK-controlled dynamic flags since it no longer needs A/B testing
• ReactFeatureFlags.www.js moves the flag from the dynamic import destructure to a static export const enableTrustedTypesIntegration: boolean = true
• The consuming code in ReactDOMComponent.js, DOMPropertyOperations.js, ReactFiberConfigDOM.js, and FormActionEventPlugin.js uses this flag to skip string coercion ('' + value) when passing values to DOM APIs like setAttribute and innerHTML, preserving Trusted Types objects
• Existing tests already use gate('enableTrustedTypesIntegration') to branch on expected behavior, so both code paths have test coverage

Confidence Score: 5/5

• This PR is safe to merge — it is a mechanical flag flip with no logic changes.
• This is a straightforward feature flag landing that flips enableTrustedTypesIntegration from false to true across all build configurations. The underlying code paths behind this flag are already well-tested and have been validated through www A/B testing (where the flag was previously __VARIANT__). The change is non-breaking: DOM APIs accept both strings and Trusted Types objects, so removing explicit string coercion is functionally identical for sites not using Trusted Types. No logic was modified — only boolean flag values were changed.
• No files require special attention.

Important Files Changed

Filename	Overview
packages/shared/ReactFeatureFlags.js	Changed enableTrustedTypesIntegration from false to true — the canonical flag definition, enabling Trusted Types integration globally.
packages/shared/forks/ReactFeatureFlags.native-fb.js	Changed enableTrustedTypesIntegration from false to true for the native FB build.
packages/shared/forks/ReactFeatureFlags.native-oss.js	Changed enableTrustedTypesIntegration from false to true for the native OSS build.
packages/shared/forks/ReactFeatureFlags.test-renderer.js	Changed enableTrustedTypesIntegration from false to true for the test renderer build.
packages/shared/forks/ReactFeatureFlags.test-renderer.native-fb.js	Changed enableTrustedTypesIntegration from false to true for the native FB test renderer build.
packages/shared/forks/ReactFeatureFlags.test-renderer.www.js	Changed enableTrustedTypesIntegration from false to true for the www test renderer build.
packages/shared/forks/ReactFeatureFlags.www-dynamic.js	Removed enableTrustedTypesIntegration from dynamic (GK-controlled) flags, since it is now permanently enabled.
packages/shared/forks/ReactFeatureFlags.www.js	Removed enableTrustedTypesIntegration from dynamic imports and added it as a static true export. A blank line separating profiler flags from other exports was consumed by the new line.

_{Last reviewed commit: b9b92b9}

[greptile-apps]

_{8 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[everettbu]

Upstream PR was closed or merged. Code is synced via branch mirror.