{"id":987516110,"date":"2024-01-12T22:36:17","date_gmt":"2024-01-12T22:36:17","guid":{"rendered":"https:\/\/workspace.trace.pt\/extending-trusted-types-to-gmail\/"},"modified":"2024-01-12T22:36:17","modified_gmt":"2024-01-12T22:36:17","slug":"extending-trusted-types-to-gmail","status":"publish","type":"post","link":"https:\/\/workspace.trace.pt\/en\/extending-trusted-types-to-gmail\/","title":{"rendered":"Extending Trusted Types to Gmail"},"content":{"rendered":"

What\u2019s changing<\/h3>\n
Last year,<\/a> we improved the client-side security of Google Docs, Sheets, Slides, Forms, Sites, Drawings, Drive, and Calendar with Trusted Types<\/a>. This browser-based runtime feature limits the uses of Document Object Model<\/a>\u00a0(DOM) APIs that are used by the apps listed above or third-party extensions. Trusted Types also reduce the possibility of Document Object Model Cross Site Scripting (DOM XSS<\/a>), which continues to be one of the most critical threats to web security.\u00a0<\/div>\n
<\/div>\n
DOM XSS occurs when a cyber attacker injects malicious code into a web page, which can then be executed by the victim’s browser. This can allow the cyber attacker to steal cookies, hijack sessions, and even take control of the victim’s computer.\u00a0<\/div>\n
<\/div>\n
To defend against this, we\u2019re excited to announce the expansion of Trusted Types to Gmail. This will provide a defense against DOM XSS and further enhances our advanced data protection controls to keep users and data safe across more of the apps they use everyday.\u00a0<\/div>\n
<\/div>\n
<\/div>\n

Who\u2019s impacted\u00a0<\/h3>\n
Developers (relying on any Chrome extensions that modify DOM APIs.)\u00a0<\/div>\n
<\/div>\n
<\/div>\n

Additional details\u00a0<\/h3>\n
This new enforcement mode will require third-party extensions to use typed objects instead of strings<\/a> when assigning values to DOM APIs. Once Trusted Types are fully enforced, the Trusted Types directive will be present in the Content Security Policy (CSP) header:\u00a0<\/div>\n
<\/div>\n
Content-Security-Policy: require-trusted-types-for ‘script’;report-uri https:\/\/mail.google.com\/mail\/cspreport\u00a0<\/span><\/div>\n
<\/div>\n
<\/div>\n

Getting started\u00a0<\/h3>\n
Admins: There is no admin control for this feature.\u00a0Developers:\u00a0To make code Trusted Types compliant, signal to the browser that data being used within the context of these DOM APIs is trustworthy by creating a Trusted Type special object.\u00a0There are several ways to be Trusted Types compliant, such as removing the offending code<\/a>, using a library (such as safevalues<\/a> or DOMPurify<\/a>), or creating a Trusted Types policy<\/a>. To ensure a seamless experience for users, we recommend employing these techniques before Trusted Types enforcement is rolled out. Failure to make code Trusted Types compliant may cause feature breakages for third-party extensions as their DOM manipulations will be blocked by the browser.\u00a0End users: There is no end user setting for this feature.\u00a0<\/div>\n
<\/div>\n

Rollout pace\u00a0<\/h3>\n
Rapid Release domains:<\/a> Extended rollout (potentially longer than 15 days for feature visibility) starting on February 12, 2024\u00a0Scheduled Release domains:<\/a> Gradual rollout (up to 15 days for feature visibility) starting on March 11, 2024\u00a0<\/div>\n
<\/div>\n

Availability\u00a0<\/h3>\n
Available to all Google Workspace customers and users with personal Google Accounts\u00a0<\/div>\n
<\/div>\n

Resources\u00a0<\/h3>\n
Google Help: Implement CSP and Trusted Types debugging in Chrome DevTools.<\/a><\/div>","protected":false},"excerpt":{"rendered":"

What\u2019s changing Last year, we improved the client-side security of Google Docs, Sheets, Slides, Forms, Sites, Drawings, Drive, and Calendar with Trusted Types. This browser-based runtime feature limits the uses of Document Object Model\u00a0(DOM) APIs that are used by the apps listed above or third-party extensions. Trusted Types also reduce the possibility of Document Object […]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-987516110","post","type-post","status-publish","format-standard","hentry","category-noticias"],"acf":[],"_links":{"self":[{"href":"https:\/\/workspace.trace.pt\/en\/wp-json\/wp\/v2\/posts\/987516110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/workspace.trace.pt\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/workspace.trace.pt\/en\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/workspace.trace.pt\/en\/wp-json\/wp\/v2\/comments?post=987516110"}],"version-history":[{"count":0,"href":"https:\/\/workspace.trace.pt\/en\/wp-json\/wp\/v2\/posts\/987516110\/revisions"}],"wp:attachment":[{"href":"https:\/\/workspace.trace.pt\/en\/wp-json\/wp\/v2\/media?parent=987516110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/workspace.trace.pt\/en\/wp-json\/wp\/v2\/categories?post=987516110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/workspace.trace.pt\/en\/wp-json\/wp\/v2\/tags?post=987516110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}