Cybersecurity glossary
What is TrustedHTML?
Learn what TrustedHTML is, how Trusted Types policies create it for innerHTML sinks, why pass-through policies fail, and how to adopt TrustedHTML without breaking UI rendering.
Definition
TrustedHTML is a Trusted Types object representing HTML markup that a browser policy has explicitly produced as safe for assignment to HTML-interpreting DOM sinks such as Element.innerHTML.
Why TrustedHTML matters
innerHTML and similar APIs are classic DOM XSS sinks. With Trusted Types enforced, those sinks reject plain strings. TrustedHTML is the typed voucher that says: “a named policy processed this markup.”
That does not magically sanitize. It forces every HTML injection path through code you can sanitize, log, and review.
How TrustedHTML is used
Enforce Trusted Types for script
CSP require-trusted-types-for guards dangerous sinks including HTML sinks.
Create a policy with createHTML
trustedTypes.createPolicy registers sanitization logic for HTML strings.
Sanitize untrusted input
The callback runs a vetted sanitizer or rejects disallowed markup.
Assign TrustedHTML to the sink
element.innerHTML = policy.createHTML(input) succeeds; raw strings throw.
Good vs bad policies
| Policy style | Verdict | Why |
|---|---|---|
| Sanitizer allowlist (e.g., maintained HTML sanitizer) | Good | Removes scripts/handlers while preserving needed markup |
| Strict reject unless input matches fixed templates | Good | Minimal HTML surface |
| Return input unchanged | Bad | Re-enables string-based DOM XSS |
| Regex strip of script tags only | Bad | Bypass-prone; not a real sanitizer |
Practical guidance
Prefer text sinks
Use textContent or safe framework bindings when markup is unnecessary.
One HTML policy
Centralize createHTML around a single well-tested sanitizer configuration.
Framework first
Rely on Vue/React/Angular escaping; reserve TrustedHTML for true rich-HTML needs.
Test bypass attempts
Include SVG, math, and event-handler payloads in sanitizer regression tests.
Checklist
- Find every innerHTML/outerHTML/document.write usage in first-party code.
- Replace string assignments with textContent or policy.createHTML.
- Use a maintained sanitizer inside createHTML—not ad-hoc filters.
- Allowlist only the HTML tags/attributes your product needs.
- Block policy creation sprawl; few named policies are easier to audit.
- Add Trusted Types Report-Only before enforcement.
- Verify third-party widgets under enforcement in staging.
- Document why each TrustedHTML call site needs HTML rather than text.
The practical takeaway
TrustedHTML is the Trusted Types value that unlocks HTML sinks under enforcement. It exists so raw strings cannot silently become markup execution.
Create TrustedHTML only through sanitizing policies, prefer non-HTML sinks whenever possible, and treat pass-through createHTML as a security defect.
Related security terms
Frequently asked questions
What is TrustedHTML?
It is a special object created by a Trusted Types policy to carry HTML that is allowed into sinks like innerHTML when Trusted Types are enforced.
How do you create TrustedHTML?
Define a policy with a createHTML callback—usually wrapping a sanitizer—and call policy.createHTML(untrustedString).
Can I cast a string to TrustedHTML?
No. Only policies created through the Trusted Types API can produce TrustedHTML values.
Should createHTML just return the input string?
No. That bypasses the security model. Sanitize or otherwise guarantee the HTML is safe for your context.
Is textContent a better alternative?
Yes whenever you need text, not markup. Avoid HTML sinks entirely when possible.
Does TrustedHTML sanitize automatically?
No. Trusted Types only enforce that a policy produced the value. Your policy must perform sanitization.
Which sinks require TrustedHTML?
HTML-interpreting sinks guarded by Trusted Types—commonly innerHTML, outerHTML, and related APIs depending on browser coverage.
References
Explore authoritative guidance and frameworks related to trustedhtml.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.