3 ms·
This isn't a programming language type safety mechanism, it's a way to tell the browser to enforce that you can't run code that could potentially be vulnerable
by m12k 7y ago
This isn't a programming language type safety mechanism, it's a way to tell the browser to enforce that you can't run code that could potentially be vulnerable to XSS, except in specific places that you designate with policies. This example was illuminating for me: https://developers.google.com/web/updates/2019/02/trusted-types#trusted-types https://developers.google.com/web/updates/2019/02/trusted-ty...
- josteink 7y agoTomato/tomato. You are effectively saying that only certain types of strings and DOM structures are allowed on certain properties and attributes. This is perfectly encodable in a type-system. I don’t see a reason to dismiss that observation outright.