payload: {"action":"created","comment":{"url":"https://api.github.com/repos/facebook/react/pulls/comments/320270523","pull_request_review_id":282992929,"id":320270523,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDMyMDI3MDUyMw==","diff_hunk":"@@ -149,5 +149,7 @@ module.exports = {\n     spyOnProd: true,\n     __PROFILE__: true,\n     __UMD__: true,\n+    TrustedTypes: true,\n+    trustedTypes: true,","path":".eslintrc.js","position":5,"original_position":5,"commit_id":"1bfb1ebc09952517bad9da5cc59aae75abbca1a9","original_commit_id":"1bfb1ebc09952517bad9da5cc59aae75abbca1a9","user":{"login":"Siegrift","id":22679154,"node_id":"MDQ6VXNlcjIyNjc5MTU0","avatar_url":"https://avatars0.githubusercontent.com/u/22679154?v=4","gravatar_id":"","url":"https://api.github.com/users/Siegrift","html_url":"https://github.com/Siegrift","followers_url":"https://api.github.com/users/Siegrift/followers","following_url":"https://api.github.com/users/Siegrift/following{/other_user}","gists_url":"https://api.github.com/users/Siegrift/gists{/gist_id}","starred_url":"https://api.github.com/users/Siegrift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Siegrift/subscriptions","organizations_url":"https://api.github.com/users/Siegrift/orgs","repos_url":"https://api.github.com/users/Siegrift/repos","events_url":"https://api.github.com/users/Siegrift/events{/privacy}","received_events_url":"https://api.github.com/users/Siegrift/received_events","type":"User","site_admin":false},"body":"In .eslintrc yes. But I think you meant it in a more general way. Currently, the native chrome implementation uses TrustedTypes (with uppercase T) and that is the preferred way to test Trusted Types.","created_at":"2019-09-03T13:27:09Z","updated_at":"2019-09-03T13:27:09Z","html_url":"https://github.com/facebook/react/pull/16157#discussion_r320270523","pull_request_url":"https://api.github.com/repos/facebook/react/pulls/16157","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/facebook/react/pulls/comments/320270523"},"html":{"href":"https://github.com/facebook/react/pull/16157#discussion_r320270523"},"pull_request":{"href":"https://api.github.com/repos/facebook/react/pulls/16157"}},"in_reply_to_id":320224131},"pull_request":{"url":"https://api.github.com/repos/facebook/react/pulls/16157","id":299064622,"node_id":"MDExOlB1bGxSZXF1ZXN0Mjk5MDY0NjIy","html_url":"https://github.com/facebook/react/pull/16157","diff_url":"https://github.com/facebook/react/pull/16157.diff","patch_url":"https://github.com/facebook/react/pull/16157.patch","issue_url":"https://api.github.com/repos/facebook/react/issues/16157","number":16157,"state":"open","locked":false,"title":"Add trusted types to react on client side","user":{"login":"Siegrift","id":22679154,"node_id":"MDQ6VXNlcjIyNjc5MTU0","avatar_url":"https://avatars0.githubusercontent.com/u/22679154?v=4","gravatar_id":"","url":"https://api.github.com/users/Siegrift","html_url":"https://github.com/Siegrift","followers_url":"https://api.github.com/users/Siegrift/followers","following_url":"https://api.github.com/users/Siegrift/following{/other_user}","gists_url":"https://api.github.com/users/Siegrift/gists{/gist_id}","starred_url":"https://api.github.com/users/Siegrift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Siegrift/subscriptions","organizations_url":"https://api.github.com/users/Siegrift/orgs","repos_url":"https://api.github.com/users/Siegrift/repos","events_url":"https://api.github.com/users/Siegrift/events{/privacy}","received_events_url":"https://api.github.com/users/Siegrift/received_events","type":"User","site_admin":false},"body":"## Trusted Types\r\n[Trusted Types](https://github.com/WICG/trusted-types) ([spec](https://wicg.github.io/trusted-types/dist/spec/), [introductory article](https://developers.google.com/web/updates/2019/02/trusted-types)) is a new experimental DOM API implemented within the WICG , with a working [Chrome implementation](https://www.chromestatus.com/feature/5650088592408576).\r\n\r\nThe API creates a few new objects available on the global object in the browser, like most other web APIs ([impl in TS](https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/trusted-types/index.d.ts) and in [Closure compiler](https://github.com/WICG/trusted-types/blob/master/externs/externs.js)).\r\n\r\nUnder certain conditions, controlled by a HTTP header (analogous to Content-Security-Policy behavior), the API can enable the enforcement - then it changes the signature of several DOM API functions and property setters, such that they accept specific object types, and reject strings. Colloquially, DOM API becomes strongly typed.\r\n\r\nFor example, with Trusted Types Element.innerHTML property setter accepts a TrustedHTML object.\r\n\r\nTrusted Type objects stringify to their inner value. This API shape is a deliberate choice that enables existing web applications and libraries to gradually migrate from strings to Trusted Types without breaking functionality. In our example, it makes it possible to write the following:\r\n\r\n```javascript\r\nconst policy = TrustedTypes.createPolicy('foo', { \r\n  createHTML: (s) => { /* some validation*/; return s} \r\n});\r\n\r\nconst trustedHTML = policy.createHTML('bar');\r\nanElement.innerHTML = trustedHTML\r\n\r\nanElement.innerHTML === 'bar'\r\n```\r\n\r\nThe above code works regardless if the Trusted Types enforcement is enabled or not.\r\n\r\nReading from the DOM is unaffected, so Element.innerHTML getter returns a string. That's for practical reasons -- web applications read from DOM more often than they write to it, and only writing exposes the application to DOM XSS risks. Typing only the setters allows us to secure web applications with minimal code changes.\r\n\r\n## Adding Trusted Types to React for client side\r\nReact applications rarely manipulate DOM directly as this is what React is for. That means that, if users want to opt in to Trusted Types, values assigned to execution sinks must be trusted. React on its own doesn't produce these execution sinks, except one [hack for IE](https://github.com/facebook/react/blob/b4178af81b02dfa0e898670ce564c4649fd8947f/packages/react-dom/src/client/setInnerHTML.js#L34). The only problem in React is the stringifying of values before assigning them to element properties or attributes. \r\n\r\nThis PR enables applications to use Trusted Types on client side. The implementation removes stringifying of trusted values in reactDOM/client. It does so **only** when Trusted Types are available in global object. If they are available, there are special [is* functions](https://wicg.github.io/trusted-types/dist/spec/#dom-trustedtypepolicyfactory-ishtml) which are used to check if the value is trusted type or not. If the value is a trusted type, we return the value itself, otherwise we preserve the original logic and stringify the value.\r\n\r\n## Problems\r\n**We cannot use Trusted Types in Internet Explorer (IE) when using dangerouslySetInnerHTML on svg elements** - The cause is that in IE svg elements doesn't have innerHTML property, which means that to support innerHTML, react needs to use a [hack](https://github.com/facebook/react/blob/b4178af81b02dfa0e898670ce564c4649fd8947f/packages/react-dom/src/client/setInnerHTML.js#L34), which wraps the innerHTML of the svg and wraps them in an svg element and assigns this to innerHTML of some HTML element. This is a problem for Trusted Types because the original svg innerHTML value is stringified. There are a few workarounds for this:\r\na) Use default Trusted Type policy allowing creating svg nodes\r\nb) Do not use svg with dangerouslySetInnerHTML but wrap the svg with div element and use dangerouslySetInnerHTML there \r\n     \r\n## Reference\r\n* [Draft: Add trusted types to react on server side](https://github.com/facebook/react/pull/16555)\r\n\r\n## Update\r\n* [TrustedURLs are deprecated](https://github.com/WICG/trusted-types/pull/204) and are going to be replaced with default policy call on javascript URLs ([which are deprecated in React and will not be supported in the future release](https://github.com/facebook/react/pull/15047/files)).\r\n* [window.TrustedTypes is going to be renamed to window.trustedTypes](https://github.com/WICG/trusted-types/pull/205) (with lowercase **t**)","created_at":"2019-07-18T19:46:46Z","updated_at":"2019-09-03T13:27:09Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5d67845b43b604e8411c175d013f88c23d61cebb","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":196858374,"node_id":"MDU6TGFiZWwxOTY4NTgzNzQ=","url":"https://api.github.com/repos/facebook/react/labels/CLA%20Signed","name":"CLA Signed","color":"e7e7e7","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/facebook/react/pulls/16157/commits","review_comments_url":"https://api.github.com/repos/facebook/react/pulls/16157/comments","review_comment_url":"https://api.github.com/repos/facebook/react/pulls/comments{/number}","comments_url":"https://api.github.com/repos/facebook/react/issues/16157/comments","statuses_url":"https://api.github.com/repos/facebook/react/statuses/1bfb1ebc09952517bad9da5cc59aae75abbca1a9","head":{"label":"Siegrift:tt-react","ref":"tt-react","sha":"1bfb1ebc09952517bad9da5cc59aae75abbca1a9","user":{"login":"Siegrift","id":22679154,"node_id":"MDQ6VXNlcjIyNjc5MTU0","avatar_url":"https://avatars0.githubusercontent.com/u/22679154?v=4","gravatar_id":"","url":"https://api.github.com/users/Siegrift","html_url":"https://github.com/Siegrift","followers_url":"https://api.github.com/users/Siegrift/followers","following_url":"https://api.github.com/users/Siegrift/following{/other_user}","gists_url":"https://api.github.com/users/Siegrift/gists{/gist_id}","starred_url":"https://api.github.com/users/Siegrift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Siegrift/subscriptions","organizations_url":"https://api.github.com/users/Siegrift/orgs","repos_url":"https://api.github.com/users/Siegrift/repos","events_url":"https://api.github.com/users/Siegrift/events{/privacy}","received_events_url":"https://api.github.com/users/Siegrift/received_events","type":"User","site_admin":false},"repo":{"id":195060968,"node_id":"MDEwOlJlcG9zaXRvcnkxOTUwNjA5Njg=","name":"react","full_name":"Siegrift/react","private":false,"owner":{"login":"Siegrift","id":22679154,"node_id":"MDQ6VXNlcjIyNjc5MTU0","avatar_url":"https://avatars0.githubusercontent.com/u/22679154?v=4","gravatar_id":"","url":"https://api.github.com/users/Siegrift","html_url":"https://github.com/Siegrift","followers_url":"https://api.github.com/users/Siegrift/followers","following_url":"https://api.github.com/users/Siegrift/following{/other_user}","gists_url":"https://api.github.com/users/Siegrift/gists{/gist_id}","starred_url":"https://api.github.com/users/Siegrift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Siegrift/subscriptions","organizations_url":"https://api.github.com/users/Siegrift/orgs","repos_url":"https://api.github.com/users/Siegrift/repos","events_url":"https://api.github.com/users/Siegrift/events{/privacy}","received_events_url":"https://api.github.com/users/Siegrift/received_events","type":"User","site_admin":false},"html_url":"https://github.com/Siegrift/react","description":"A declarative, efficient, and flexible JavaScript library for building user interfaces.","fork":true,"url":"https://api.github.com/repos/Siegrift/react","forks_url":"https://api.github.com/repos/Siegrift/react/forks","keys_url":"https://api.github.com/repos/Siegrift/react/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Siegrift/react/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Siegrift/react/teams","hooks_url":"https://api.github.com/repos/Siegrift/react/hooks","issue_events_url":"https://api.github.com/repos/Siegrift/react/issues/events{/number}","events_url":"https://api.github.com/repos/Siegrift/react/events","assignees_url":"https://api.github.com/repos/Siegrift/react/assignees{/user}","branches_url":"https://api.github.com/repos/Siegrift/react/branches{/branch}","tags_url":"https://api.github.com/repos/Siegrift/react/tags","blobs_url":"https://api.github.com/repos/Siegrift/react/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Siegrift/react/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Siegrift/react/git/refs{/sha}","trees_url":"https://api.github.com/repos/Siegrift/react/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Siegrift/react/statuses/{sha}","languages_url":"https://api.github.com/repos/Siegrift/react/languages","stargazers_url":"https://api.github.com/repos/Siegrift/react/stargazers","contributors_url":"https://api.github.com/repos/Siegrift/react/contributors","subscribers_url":"https://api.github.com/repos/Siegrift/react/subscribers","subscription_url":"https://api.github.com/repos/Siegrift/react/subscription","commits_url":"https://api.github.com/repos/Siegrift/react/commits{/sha}","git_commits_url":"https://api.github.com/repos/Siegrift/react/git/commits{/sha}","comments_url":"https://api.github.com/repos/Siegrift/react/comments{/number}","issue_comment_url":"https://api.github.com/repos/Siegrift/react/issues/comments{/number}","contents_url":"https://api.github.com/repos/Siegrift/react/contents/{+path}","compare_url":"https://api.github.com/repos/Siegrift/react/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Siegrift/react/merges","archive_url":"https://api.github.com/repos/Siegrift/react/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Siegrift/react/downloads","issues_url":"https://api.github.com/repos/Siegrift/react/issues{/number}","pulls_url":"https://api.github.com/repos/Siegrift/react/pulls{/number}","milestones_url":"https://api.github.com/repos/Siegrift/react/milestones{/number}","notifications_url":"https://api.github.com/repos/Siegrift/react/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Siegrift/react/labels{/name}","releases_url":"https://api.github.com/repos/Siegrift/react/releases{/id}","deployments_url":"https://api.github.com/repos/Siegrift/react/deployments","created_at":"2019-07-03T13:39:10Z","updated_at":"2019-07-18T08:37:06Z","pushed_at":"2019-08-30T13:45:08Z","git_url":"git://github.com/Siegrift/react.git","ssh_url":"git@github.com:Siegrift/react.git","clone_url":"https://github.com/Siegrift/react.git","svn_url":"https://github.com/Siegrift/react","homepage":"https://reactjs.org","size":143068,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":0,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"facebook:master","ref":"master","sha":"2c1e6bf619e404fd1ac464eb35eff4c09b3861b3","user":{"login":"facebook","id":69631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY5NjMx","avatar_url":"https://avatars3.githubusercontent.com/u/69631?v=4","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"repo":{"id":10270250,"node_id":"MDEwOlJlcG9zaXRvcnkxMDI3MDI1MA==","name":"react","full_name":"facebook/react","private":false,"owner":{"login":"facebook","id":69631,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY5NjMx","avatar_url":"https://avatars3.githubusercontent.com/u/69631?v=4","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/facebook/react","description":"A declarative, efficient, and flexible JavaScript library for building user interfaces.","fork":false,"url":"https://api.github.com/repos/facebook/react","forks_url":"https://api.github.com/repos/facebook/react/forks","keys_url":"https://api.github.com/repos/facebook/react/keys{/key_id}","collaborators_url":"https://api.github.com/repos/facebook/react/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/facebook/react/teams","hooks_url":"https://api.github.com/repos/facebook/react/hooks","issue_events_url":"https://api.github.com/repos/facebook/react/issues/events{/number}","events_url":"https://api.github.com/repos/facebook/react/events","assignees_url":"https://api.github.com/repos/facebook/react/assignees{/user}","branches_url":"https://api.github.com/repos/facebook/react/branches{/branch}","tags_url":"https://api.github.com/repos/facebook/react/tags","blobs_url":"https://api.github.com/repos/facebook/react/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/facebook/react/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/facebook/react/git/refs{/sha}","trees_url":"https://api.github.com/repos/facebook/react/git/trees{/sha}","statuses_url":"https://api.github.com/repos/facebook/react/statuses/{sha}","languages_url":"https://api.github.com/repos/facebook/react/languages","stargazers_url":"https://api.github.com/repos/facebook/react/stargazers","contributors_url":"https://api.github.com/repos/facebook/react/contributors","subscribers_url":"https://api.github.com/repos/facebook/react/subscribers","subscription_url":"https://api.github.com/repos/facebook/react/subscription","commits_url":"https://api.github.com/repos/facebook/react/commits{/sha}","git_commits_url":"https://api.github.com/repos/facebook/react/git/commits{/sha}","comments_url":"https://api.github.com/repos/facebook/react/comments{/number}","issue_comment_url":"https://api.github.com/repos/facebook/react/issues/comments{/number}","contents_url":"https://api.github.com/repos/facebook/react/contents/{+path}","compare_url":"https://api.github.com/repos/facebook/react/compare/{base}...{head}","merges_url":"https://api.github.com/repos/facebook/react/merges","archive_url":"https://api.github.com/repos/facebook/react/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/facebook/react/downloads","issues_url":"https://api.github.com/repos/facebook/react/issues{/number}","pulls_url":"https://api.github.com/repos/facebook/react/pulls{/number}","milestones_url":"https://api.github.com/repos/facebook/react/milestones{/number}","notifications_url":"https://api.github.com/repos/facebook/react/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/facebook/react/labels{/name}","releases_url":"https://api.github.com/repos/facebook/react/releases{/id}","deployments_url":"https://api.github.com/repos/facebook/react/deployments","created_at":"2013-05-24T16:15:54Z","updated_at":"2019-09-03T13:22:57Z","pushed_at":"2019-09-02T10:21:49Z","git_url":"git://github.com/facebook/react.git","ssh_url":"git@github.com:facebook/react.git","clone_url":"https://github.com/facebook/react.git","svn_url":"https://github.com/facebook/react","homepage":"https://reactjs.org","size":147462,"stargazers_count":135429,"watchers_count":135429,"language":"JavaScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":25359,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":835,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":25359,"open_issues":835,"watchers":135429,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/facebook/react/pulls/16157"},"html":{"href":"https://github.com/facebook/react/pull/16157"},"issue":{"href":"https://api.github.com/repos/facebook/react/issues/16157"},"comments":{"href":"https://api.github.com/repos/facebook/react/issues/16157/comments"},"review_comments":{"href":"https://api.github.com/repos/facebook/react/pulls/16157/comments"},"review_comment":{"href":"https://api.github.com/repos/facebook/react/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/facebook/react/pulls/16157/commits"},"statuses":{"href":"https://api.github.com/repos/facebook/react/statuses/1bfb1ebc09952517bad9da5cc59aae75abbca1a9"}},"author_association":"NONE"}}
other: {"actor":{"display_login":"Siegrift"}}