[ Web Proxy ]
URL:
Viewing: https://developer.mozilla.org/ja/docs/Web/API/HTMLScriptElement/textContent [Back]  [Original]

HTMLScriptElement: textContent - Web API | MDN

MDN Web Docs

View in English Always switch to English

HTMLScriptElement: textContent

Baseline
*

20157

*

innerText HTMLScriptElement <script> text innerText

TrustedScript

TypeError

CSP

textContent HTMLScriptElement <script>

type

src text

textContent HTMLElement TrustedScript

textContent text innerText (XSS) scriptElement <script> untrustedCode :

js
const untrustedCode = "alert('Potentially evil code!');";
scriptElement.textContent = untrustedCode; // 

TrustedScript CSP require-trusted-types-for

TrustedScript

XSS textContent TrustedScript

tinyfill JavaScript API

js
if (typeof trustedTypes === "undefined")
  trustedTypes = { createPolicy: (n, rules) => rules };

TrustedTypePolicy createScript() TrustedTypePolicy

js
const policy = trustedTypes.createPolicy("inline-script-policy", {
  createScript(input) {
    // 
    if (input === "const num = 10;\nconsole.log(num)") {
      return input; // 
    }
    throw new TypeError(`: ${input}`);
  },
});

html
<script id="el"></script>
js
// 
const el = document.getElementById("el");

policy trustedScript

js
// 
const untrustedScriptOne = "const num = 10;\nconsole.log(num)";

//  TrustedScript 
const trustedScript = policy.createScript(untrustedScriptOne);

// TrustedScript
el.textContent = trustedScript;

textContent, text, innerText

textContent

js
// textContent 
el.textContent = "console.log(10);";

console.log(`textContent: ${el.textContent}`);
// "textContent: console.log(10);"

console.log(`text: ${el.text}`);
// "text: console.log(10);"

console.log(`innerText: ${el.innerText}`);
// "innerText: console.log(10);"

// text 
el.text = "const num = 10;\nconsole.log(num)";

console.log(`textContent: ${el.textContent}`);
// textContent: const num = 10; console.log(num)"

console.log(`text: ${el.text}`);
// "text: const num = 10; console.log(num)"

console.log(`innerText: ${el.innerText}`);
// "innerText: const num = 10; console.log(num)"

// innerText 
el.innerText = "const num = 10;alert('Help')";

console.log(`textContent: ${el.textContent}`);
// textContent: const num = 10;alert('Help')"

console.log(`text: ${el.text}`);
// "text: const num = 10;alert('Help')"

console.log(`innerText: ${el.innerText}`);
// "innerText: const num = 10;alert('Help')"

Trusted Types
# dom-htmlscriptelement-textcontent


Web Proxy Viewer  |  New URL  |  Original Page