How to add trustedtype policy for the Adobe launch scripts injected to the AEM pages?

Question

Hi all,Recently we got a security requirement to add the “require-trusted-types “ directive in the csp with value “script’ to lock down DOM XSS injection sinks. However when I add this to the CSP header, it’s blocking couple of lines in the launch scripts. Now I understand that I have to add the trustedPolicy and create a trusted policy in the JS and add that policy-name in the “trusted-types” directive.But how do I add that in the launch scripts? Because from AEM, we are only adding script url, the scripts are not written in the aem code base. Looking for any inputs to implement this.Thanks,Dayana

akhil_merupula · Accepted Answer

Hi ​@Dayana12,Fair concern, and you’re right that a pass-through default policy gives up most of the guarantee.Two things worth separating though. The default policy is a fallback, not a blanket bypass,it only fires when a raw string reaches a sink without an explicit TrustedHTML/TrustedScriptURL. Your own code should still use a named policy with real sanitization; the default is only there to catch third-party scripts you can’t modify.And it doesn’t have to stay pass-through. Since you own the callbacks, you can allow-list hostnames in createScriptURL, run createHTML through DOMPurify, and throw outright in createScript. Throwing makes the assignment fail with a TypeError, so it’s real enforcement.Before enforcing, I’d run Content-Security-Policy-Report-Only with require-trusted-types-for 'script' and a report-uri. That tells you exactly which sinks Launch touches on your property, so you can tighten each callback based on what’s actually firing.

akhil_merupula · Answer

Hi ​@Dayana12,This is a known challenge with Launch and Trusted Types,since Launch dynamically injects scripts, it internally uses DOM APIs that violate require-trusted-types-for 'script'.The practical options:Option 1: Add 'allow-duplicates' and a named policy in your own codeYou can’t modify Launch’s internal script, but you can create a Trusted Types policy that wraps the violations Launch triggers. The policy needs to be named and registered before Launch loads:if (window.trustedTypes && trustedTypes.createPolicy) { trustedTypes.createPolicy('default', {  createScriptURL: (url) => url,  createScript: (s) => s,  createHTML: (s) => s });}Using 'default' as the policy name catches violations from scripts that don’t create their own policy,which covers Launch.Option 2: Raise with AdobeAdobe Launch/Tags doesn’t natively support Trusted Types yet. This is an open gap,worth raising via Adobe Support to get it on the roadmap and check if there’s a newer Launch runtime build that handles this better.The default policy approach is the most pragmatic workaround today, but validate it covers all the violation types you’re seeing in the console errors.

Sign up

Login with SSO

Login to the community

Login with SSO