Cybersecurity glossary
What is TrustedScript?
Learn what TrustedScript is, how Trusted Types policies gate eval-like sinks, when createScript is appropriate, and how to avoid reintroducing DOM XSS through weak policies.
Definition
TrustedScript is a Trusted Types object representing JavaScript source text that a policy has explicitly produced as allowable for assignment to script-code sinks such as eval, Function constructors, or similar guarded APIs when Trusted Types are enforced.
Why TrustedScript matters
String-to-script sinks are among the most dangerous browser APIs. If untrusted data reaches eval or new Function, XSS is immediate. With Trusted Types enforced, those sinks demand a TrustedScript value from a policy—stopping casual eval(userInput) mistakes.
The long-term goal is still to delete script-evaluation sinks, not to bless them.
How TrustedScript fits the model
Detect script-code sinks
Find eval, Function, setTimeout/setInterval with strings, and similar patterns.
Prefer eliminating the sink
Replace dynamic code execution with parsed data, JSON, or explicit function maps.
If unavoidable, policy-gate constants
createScript returns TrustedScript only for exact developer-controlled strings.
Enforcement blocks raw strings
Unguarded string evaluation throws under Trusted Types.
Safe and unsafe createScript patterns
| Pattern | Risk | Guidance |
|---|---|---|
| createScript only for fixed literals | Low | Acceptable temporary bridge |
| createScript(userControlled) | Critical | Do not; this is XSS |
| Template concatenation then createScript | High | Treat as code injection unless fully static |
| Remove eval entirely | Lowest | Preferred end state |
Design recommendations
Data, not code
Pass configuration as JSON and map operations to real functions.
No string timers
Use setTimeout(fn, ms) with function references, never string code.
CSP alignment
Keep unsafe-eval out of script-src while adopting Trusted Types.
Minimal policy surface
Avoid a general-purpose createScript that accepts arbitrary text.
Checklist
- Ban new eval/Function usages in lint rules.
- Migrate existing dynamic code paths to data-driven designs.
- If a TrustedScript policy is required, allow only exact constant strings.
- Log and alert on any createScript invocation in production.
- Cover string-based setTimeout/setInterval in the same review.
- Use Report-Only Trusted Types to find hidden library sinks.
- Do not confuse TrustedScript with loading external files (use TrustedScriptURL).
- Retire the policy once legacy sinks are gone.
The practical takeaway
TrustedScript is the Trusted Types object for script-code sinks. Under enforcement, raw strings cannot be evaluated as JavaScript through guarded APIs.
Treat createScript as an emergency gate for developer-controlled constants—not as a way to “safe-eval” user input—and delete eval-like sinks whenever you can.
Related security terms
Frequently asked questions
What is TrustedScript?
It is a typed object created by a Trusted Types policy for JavaScript code that may be passed to dangerous script-evaluation sinks under enforcement.
When do I need TrustedScript?
When application code still uses eval, new Function, or other sinks that execute strings as script and Trusted Types guard those sinks.
Is createScript a good idea for user input?
Almost never. Executing attacker-influenced strings as script is inherently unsafe. Prefer eliminating eval-like patterns.
How does TrustedScript differ from TrustedScriptURL?
TrustedScript is for script source text. TrustedScriptURL is for URLs used to load script files.
Can a policy safely allowlist fixed scripts?
A policy that returns TrustedScript only for exact known-constant strings can be acceptable for rare legacy bridges.
Does CSP unsafe-eval still matter?
Yes. Avoid unsafe-eval in CSP. Trusted Types add sink typing but do not make arbitrary code execution safe.
What should teams do first?
Remove eval/new Function usages. Use TrustedScript only as a temporary bridge for code you fully control.
References
Explore authoritative guidance and frameworks related to trustedscript.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.