Content-Security-Policy: require-trusted-types-for 'script';

// Content-Security-Policy: require-trusted-types-for 'script'; trusted-types foo;

const attackerInput = '<svg onload="alert(/cross-site-scripting/)" />';
const el = document.createElement('div');

if (typeof trustedTypes !== 'undefined') {
  // Create a policy that can create TrustedHTML values
  // after sanitizing the input strings with DOMPurify library.
  const sanitizer = trustedTypes.createPolicy('foo', {
    createHTML: (input) => DOMPurify.sanitize(input)
  });

  el.innerHTML = sanitizer.createHTML(attackerInput);  // Puts the sanitized value into the DOM.
  el.innerHTML = attackerInput;                        // Rejects a string value; throws a TypeError.
}