result=sensitiveOperation`trusted0 ${untrusted} trusted1`// Authored by dev ^^^^^^^^ ^^^^^^^^// May come from outside ^^^^^^^^^

function(trustedStrings, ...untrustedArguments){if(Reflect.isTemplateObject(trustedStrings)// instanceof provides a same-Realm guarantee for early frozen objects.&&trustedStringsinstanceofArray){// Proceed knowing that trustedStrings come from// the JavaScript module's authors.}else{// Do not trust trustedStrings}}

constattackerControlledString='((x) => x)`evil string`';// Naive codeletx=eval(attackerControlledString)console.log(Reflect.isTemplateObject(x));

const{ Array, Reflect, TypeError }=globalThis;const{ createPolicy }=trustedTypes;const{ isTemplateObject }=Reflect;const{error: consoleErr}=console;/** * A tag function that produces *TrustedHTML* or null if the * policy name "trustedHTMLTagFunction" is not available. */exporttrustedHTML=(()=>{// We use TrustedType's first-come-first-serve policy name restrictions// to provision this scope with sensitiveOperation.constpolicyName='trustedHTMLTagFunction';letpolicy;try{policy=createPolicy('trustedHTMLTagFunction',{createHTML(s){returns}});}catch(ex){consoleErr(`${policyName} is not an allowed trustedTypes policy name`);returnnull;}// This is the sensitive operation.const{ createHTML }=policy;// This tag function uses isTemplateObject to reject strings that// do not appear in user code in the same realm.//// With a reliable isTemplateObject check, the attack surface is// <= |set of template applications in trusted code|.//// That set is finite.//// Without a reliable isTemplateObject check, the attack surface is// <= |set of attacker controlled strings|. That is, in practice,// unbounded.//// This assumes no attacker has eval.consttrustedHTMLTagFunction=(strings)=>{if(isTemplateObject(strings)&&stringsinstanceofArray){returncreateHTML(strings.raw[0]);}thrownewTypeError("Expected template object");};// With the check it's safe to export this tag function that closes// over a sensitive operation to anyone.returntrustedHTMLTagFunction;})()

// A naive, but non-malicious function.functionf(x){// People trust trustedHTMLTagFunction.// Our HTML is trustworthy because <bad argument> so we'll just// piggyback off that by using a value that looks like a template object.// What could possibly go wrong?consts=dodgyMarkdownToHTMLConverter(x);constpseudoTemplateObject=[s];pseudoTemplateObject.raw=Object.freeze([s]);returntrustedHTML(Object.freeze(pseudoTemplateObject));}// An attacker controlled string reaches f().constpayload='<img onerror=alert(document.origin) src=x>';console.log(`f(${JSON.stringify(payload)}) = ${f(payload)}`);