Trusted Types Demo

This demo uses the Trusted Types API to ensure untrusted HTML is sanitized through a Trusted Types policy before being assigned to innerHTML. It uses a "tinyfill" for backwards compatibility.

1. Input Content

Enter some HTML containing both safe formatting and unsafe scripts or event handlers:

<p>Hello, <strong>world</strong>!</p><img src="x" onerror="alert('XSS')"><script>alert('XSS')</script> Result in innerHTML: