TheTrustedScriptURL interface of theTrusted Types API represents a string that a developer can insert into aninjection sink that will parse it as a URL of an external script. These objects are created viaTrustedTypePolicy.createScriptURL() and therefore have no constructor.

The value of aTrustedScriptURL object is set when the object is created and cannot be changed by JavaScript as there is no setter exposed.

Instance methods

TrustedScriptURL.toJSON()

Returns a JSON representation of the stored data.

TrustedScriptURL.toString()

A string containing the sanitized URL.

Examples

The constantsanitized is an object created via a Trusted Types policy.

const sanitized = scriptPolicy.createScriptURL(  "https://example.com/my-script.js",);console.log(sanitized); /* a TrustedScriptURL object */

Specifications

Browser compatibility

See also

• Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types