| [ Web Proxy ] |
| Viewing: https://developer.mozilla.org/ja/docs/Web/API/HTMLScriptElement/textContent | [Back] [Original] |
Get to know MDN better
: API (XSS)
innerText HTMLScriptElement <script>
text innerText
textContent HTMLScriptElement <script>
src text
textContent HTMLElement
TrustedScript
textContent text innerText (XSS)
scriptElement <script> untrustedCode :
const untrustedCode = "alert('Potentially evil code!');";
scriptElement.textContent = untrustedCode; //
TrustedScript CSP require-trusted-types-for
XSS textContent TrustedScript
tinyfill JavaScript API
if (typeof trustedTypes === "undefined")
trustedTypes = { createPolicy: (n, rules) => rules };
TrustedTypePolicy createScript() TrustedTypePolicy
const policy = trustedTypes.createPolicy("inline-script-policy", {
createScript(input) {
//
if (input === "const num = 10;\nconsole.log(num)") {
return input; //
}
throw new TypeError(`: ${input}`);
},
});
<script id="el"></script>
//
const el = document.getElementById("el");
policy trustedScript
//
const untrustedScriptOne = "const num = 10;\nconsole.log(num)";
// TrustedScript
const trustedScript = policy.createScript(untrustedScriptOne);
// TrustedScript
el.textContent = trustedScript;
textContent, text, innerText textContent
// textContent
el.textContent = "console.log(10);";
console.log(`textContent: ${el.textContent}`);
// "textContent: console.log(10);"
console.log(`text: ${el.text}`);
// "text: console.log(10);"
console.log(`innerText: ${el.innerText}`);
// "innerText: console.log(10);"
// text
el.text = "const num = 10;\nconsole.log(num)";
console.log(`textContent: ${el.textContent}`);
// textContent: const num = 10; console.log(num)"
console.log(`text: ${el.text}`);
// "text: const num = 10; console.log(num)"
console.log(`innerText: ${el.innerText}`);
// "innerText: const num = 10; console.log(num)"
// innerText
el.innerText = "const num = 10;alert('Help')";
console.log(`textContent: ${el.textContent}`);
// textContent: const num = 10;alert('Help')"
console.log(`text: ${el.text}`);
// "text: const num = 10;alert('Help')"
console.log(`innerText: ${el.innerText}`);
// "innerText: const num = 10;alert('Help')"
| Trusted Types # dom-htmlscriptelement-textcontent |
HTMLScriptElementAbortControllerAbortSignalAbstractRangeAttrCDATASectionCharacterDataCommentCustomEventDOMErrorDOMExceptionDOMImplementationDOMParserDOMTokenListDocumentDocumentFragmentDocumentTypeElementEventEventTargetHTMLCollectionMutationObserverMutationRecordNamedNodeMapNodeNodeIteratorNodeListProcessingInstructionQuotaExceededErrorRangeShadowRootStaticRangeTextTreeWalkerXMLDocumentXPathEvaluatorXPathExpressionXPathResultXSLTProcessor| Web Proxy Viewer | New URL | Original Page |