Trusted Types & DOM Sink XSS Tester
Trusted Types eliminate DOM XSS by forcing dangerous sinks like innerHTML
to accept only policy-sanitized values. This tool detects API support, lets you
experiment with sanitization policies against real XSS payloads, and generates the CSP
header that enforces it.
Tool interface
🔍 API Detection
🧪 Sanitization Playground
Choose a sanitizer and an XSS payload, then run the test to see what survives.
🛡️ Enforcement CSP Header
Trusted Types only prevent XSS when enforced via CSP. Send this header on your pages. Start in report-only mode to find violations before enforcing.
Content-Security-Policy: require-trusted-types-for 'script'; trusted-types myPolicy;
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri /csp-violations;
Introduction
DOM-based XSS happens when untrusted data reaches a dangerous sink. Trusted Types is the browser's structural fix: it makes those sinks reject raw strings entirely. This tester helps you understand sanitizer weaknesses and deploy Trusted Types correctly.
How It Works
- Detects
window.trustedTypesand policy-creation support. - Runs four preset sanitizers (or your custom function) against five XSS payloads.
- Scans the sanitized output for surviving
<script>, event handlers, andjavascript:URLs. - Demonstrates real
trustedTypes.createPolicy()creation. - Generates enforcing and report-only CSP headers.
Privacy
All testing runs locally in your browser. No content is transmitted. No API calls, no tracking.
Limitations
- Trusted Types enforcement requires the CSP header on the served page; this tool can demonstrate the API but not force enforcement here.
- Preset sanitizers are educational — use a vetted library like DOMPurify in production.
- The custom sanitizer runs your own code locally; it is not sandboxed beyond the page context.
FAQ
Does stripping <script> prevent XSS?
No. Attackers use event handlers (onerror, onload), javascript: URLs, and many other vectors. Try the payloads in the playground to see this yourself.
Is my data uploaded?
No. Everything runs locally in your browser. Nothing is transmitted.