1. Trusted Types for DOM manipulation

    An API that forces developers to be very explicit about their use of powerful DOM-injection APIs. Can greatly improve security against XSS attacks.

  2. document api: execcommand: `inserthtml` command: requires `trustedhtml` instance when trusted types are enforced

  3. document api: `parsehtmlunsafe()` static method: requires `trustedhtml` instance when trusted types are enforced

  4. document api: writeln: requires `trustedhtml` instance when trusted types are enforced

  5. document api: write: requires `trustedhtml` instance when trusted types are enforced

  6. domparser api: parsefromstring: requires `trustedhtml` instance when trusted types are enforced

  7. element api: innerhtml: requires `trustedhtml` instance when trusted types are enforced

  8. element api: insertadjacenthtml: requires `trustedhtml` instance when trusted types are enforced

  9. element api: outerhtml: requires `trustedhtml` instance when trusted types are enforced

  10. element api: setattributens: requires `value` parameter to be `trustedhtml`, `trustedscript`, or `trustedscripturl` instance when trusted types enforced (matching attribute type)

  11. element api: setattribute: requires `value` parameter to be `trustedhtml` instance (for `iframe.srcdoc`), or `trustedscripturl` (for html `script.src`, and svg `script.href`) when trusted types are enforced

  12. element api: sethtmlunsafe: requires `trustedhtml` instance when trusted types are enforced

  13. htmliframeelement api: srcdoc: requires `trustedhtml` instance when trusted types are enforced

  14. htmlscriptelement api: innertext: requires `trustedscript` instance when trusted types are enforced

  15. htmlscriptelement api: src: requires `trustedscripturl` instance when trusted types are enforced

  16. htmlscriptelement api: textcontent: requires `trustedscript` instance in `htmlscriptelement` when trusted types are enforced.

  17. htmlscriptelement api: text: requires `trustedscript` instance when trusted types are enforced.

  18. range api: createcontextualfragment: requires `trustedhtml` instance when trusted types are enforced

  19. serviceworkercontainer api: register: `scripturl` parameter requires `trustedscripturl` instance when trusted types are enforced

  20. setinterval api: `code` parameter requires `trustedscript` instance when trusted types are enforced.

  21. settimeout api: `code` parameter requires `trustedscript` instance when trusted types are enforced.

  22. shadowroot api: innerhtml: requires `trustedhtml` instance when trusted types are enforced

  23. shadowroot api: sethtmlunsafe: requires `trustedhtml` instance when trusted types are enforced

  24. sharedworker api: `sharedworker()` constructor: `url` parameter requires `trustedscripturl` instance when trusted types are enforced

  25. svganimatedstring api: baseval: requires `trustedscripturl` instance when trusted types are enforced

  26. trustedtypes api

  27. workerglobalscope api: importscripts: `urls` parameter requires `trustedscripturl` instances when trusted types are enforced

  28. worker api: `worker()` constructor: requires `url` parameter to be `trustedscripturl` instance when trusted types are enforced

  29. headers http header: content-security-policy: require-trusted-types-for

  30. headers http header: content-security-policy: script-src: `trusted-types-eval` source expression

  31. headers http header: content-security-policy: trusted-types

  32. javascript built-in: function: `function()` constructor: requires arguments to be `trustedscript` instance when trusted types are enforced