Attack payloads

5 of 5 free runs left.

Policy code

// Create a Trusted Types policy once, then route every
// innerHTML assignment through it.
const policy = trustedTypes.createPolicy("escape", {
  createHTML: (input) => sanitize(input), // your sanitizer here
});

// The sink now only accepts TrustedHTML, never raw strings:
el.innerHTML = policy.createHTML(userInput);

// Without a policy this throws once the CSP below is live:
//   el.innerHTML = userInput; // TypeError: requires TrustedHTML
//
// Enforce it with a real header:
//   Content-Security-Policy: require-trusted-types-for 'script';

Rendered through the policy

Before vs after

<img src="x" onerror="alert('XSS')">

// run the policy to see the sanitized output

With the CSP header live, assigning the left side directly to innerHTML throws a TypeError. That is the whole point: dangerous sinks stop accepting strings entirely, so one missed sanitize call cannot become an XSS.