HTMLScriptElement.src - update for TrustedScriptURL #41413
+91
−3
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
Content:WebAPI
32 tasks
hamishwillee
commented
Oct 7, 2025
![github-actions[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| - `TypeError` | ||
| - : Thrown if the property is set with a string when [Trusted Types](/en-US/docs/Web/API/Trusted_Types_API) are [enforced by a CSP](/en-US/docs/Web/API/Trusted_Types_API#using_a_csp_to_enforce_trusted_types) and no default policy is defined. | ||
| This is also thrown if the fetched URL cannot be successfully parsed as its indicated type, such as a module or importmap. | ||
|
|
There was a problem hiding this comment.
[mdn-linter] reported by reviewdog 🐶
Suggested change
hamishwillee
commented
Oct 7, 2025
|
|
||
| - `TypeError` | ||
| - : Thrown if the property is set with a string when [Trusted Types](/en-US/docs/Web/API/Trusted_Types_API) are [enforced by a CSP](/en-US/docs/Web/API/Trusted_Types_API#using_a_csp_to_enforce_trusted_types) and no default policy is defined. | ||
| This is also thrown if the fetched URL cannot be successfully parsed as its indicated type, such as a module or importmap. |
There was a problem hiding this comment.
This isn't quite right, but I'm not sure how to be precise.
I believe it is a NetworkError on fetching. TypeError is thrown for an importmap during parsing (https://html.spec.whatwg.org/multipage/webappapis.html#import-map-authoring-requirements), and I think it is a Syntax error you get normally on parsing JavaScript.
Thoughts?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This updates the TrustedScriptURL documentation for
HTMLScriptElement/srcto include information about using it with trusted types.I don't know why/when it would ever make sense to do take an untrusted string, and if you did, to use trusted types. I've presented this primarily as "Use CSP to restrict the script options but if you have to take and untrusted script then you can use TT".
Project tracking in #37518