FF145 Relnote: Trusted Types early beta

[hamishwillee]

FF145 supports Trusted Types in early beta in https://bugzilla.mozilla.org/show_bug.cgi?id=1992941

This adds a release note, experimental feature, and updates the API overview page.

This is a minimal update to provide a coherent story, with links to most affected interfaces. There are still quite a few interfaces that actually need updates but they will come in follow on PRs.

Related work can be tracked in #41507

[github-actions]

Preview URLs

• /en-US/docs/Mozilla/Firefox/Experimental_features
• /en-US/docs/Mozilla/Firefox/Releases/145
• /en-US/docs/Web/API/Trusted_Types_API
• /en-US/docs/Web/HTTP/Guides/CSP
• /en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy

Flaws (24)

Note! 2 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Mozilla/Firefox/Experimental_features
Title: Experimental features in Firefox
Flaw count: 19

• macros:
  • Macro produces link /en-US/docs/Web/CSS/initial-letter which is a redirect
  • Macro produces link /en-US/docs/Web/CSS/width which is a redirect
  • Macro produces link /en-US/docs/Web/CSS/scroll-timeline-name which is a redirect
  • Macro produces link /en-US/docs/Web/CSS/scroll-timeline-axis which is a redirect
  • Macro produces link /en-US/docs/Web/CSS/scroll-timeline which is a redirect
  • and 14 more flaws omitted

---

URL: /en-US/docs/Mozilla/Firefox/Releases/145
Title: Firefox 145 release notes for developers (Beta)
Flaw count: 2

• macros:
  • Macro produces link /en-US/docs/Web/CSS/text-autospace which is a redirect
  • Macro produces link /en-US/docs/Web/CSS/text-decoration which is a redirect

---

URL: /en-US/docs/Web/HTTP/Guides/CSP
Title: Content Security Policy (CSP)
Flaw count: 3

• unknown:
  • No generic content config found
  • no blog root
  • no blog root

External URLs (2)

URL: /en-US/docs/Mozilla/Firefox/Experimental_features
Title: Experimental features in Firefox

• https://bugzil.la/1992941 (1 time) (Note! This may be a new URL 👀)

---

URL: /en-US/docs/Mozilla/Firefox/Releases/145
Title: Firefox 145 release notes for developers (Beta)

• https://bugzil.la/1976656 (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2025-11-02 23:01:20)

[github-actions]

This pull request has merge conflicts that must be resolved before it can be merged.

[github-actions]

This pull request has merge conflicts that must be resolved before it can be merged.

[github-actions]

This pull request has merge conflicts that must be resolved before it can be merged.

[hamishwillee]

FYI this is an exhaustive list of direct injection sinks, taken from @fred-wang compiled list in w3c/trusted-types#494 (comment).

This is linked from the first mention of injection sinks and the release note.

[hamishwillee]

This follows on from discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=1992941#c6 and earlier in https://bugzilla.mozilla.org/show_bug.cgi?id=1928932#c22

There are cases where you can't know on assignment that an untrusted string will be used somewhere where it matters. For those cases the TT checks are run when (say) the script is injected.
This probably requires a section of its own with concrete example (see second link above).
For now, I am doing this. I hope to come back to this and expand this section, but perhaps not before the Firefox release.

[bsmth]

Super, thanks for documenting.

[hamishwillee]

@bsmth Would appreciate a review sooner rather than later if you could. @wbamberg I'd happily have review from you also - essentially to check you don't mind where I put the list of injection sinks.

[bsmth]

Nice, a couple of suggestions for you, but ready to go when you've had a look 👀

[wbamberg]

@bsmth Would appreciate a review sooner rather than later if you could. @wbamberg I'd happily have review from you also - essentially to check you don't mind where I put the list of injection sinks.

It's great to see the list of sinks. We talked about this back in #37917 (comment). Personally I would probably have had it as an H3 at the end of "Concepts and usage", just because I feel like everything after that point is kind of formal ("items defined in this specification") and it's more helpful to characterize it as a list of injection sinks (which you have done, but that doesn't fit this formal structure).

What I mean by formal is really, the same format for every API overview page (and theoretically possible to generate from the IDL). This is generally two things:

• interfaces defined in this specification
• additions to other interfaces

Technically the list of injection sinks is "additions to other interfaces" of course. But it's much more helpful to frame them as a list of injection sinks. But that's not a formal description available in API overview pages.

Anyway, that's my thinking. But it's much better to have the list than not, and I could appreciate that my complaint here is pretty niche, so I won't argue with what you have here.

[github-actions]

[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

	- Addition of the {{domxref("TrustedTypePolicyFactory")}}, {{domxref("TrustedTypePolicy")}}, {{domxref("TrustedHTML")}}, {{domxref("TrustedScript")}}, {{domxref("TrustedScriptURL")}} interfaces, and the `trustedTypes` property on {{domxref("Window/trustedTypes", "Window")}} and {{domxref("WorkerGlobalScope/trustedTypes", "WorkerGlobalScope")}}.
	- Addition of the {{domxref("TrustedTypePolicyFactory")}}, {{domxref("TrustedTypePolicy")}}, {{domxref("TrustedHTML")}}, {{domxref("TrustedScript")}}, {{domxref("TrustedScriptURL")}} interfaces, and the `trustedTypes` property on {{domxref("Window/trustedTypes", "Window")}} and {{domxref("WorkerGlobalScope/trustedTypes", "WorkerGlobalScope")}}.

[hamishwillee]

Anyway, that's my thinking. But it's much better to have the list than not, and I could appreciate that my complaint here is pretty niche, so I won't argue with what you have here.

I'd tried several places; everywhere is a compromise - my decision to put it where it was was more about making it a level 2 heading because I wanted it in the TOC for the usual reasons.
Don't feel strongly, so have moved it into concepts as suggested.

Thanks very much to both of you for the reviews.

[wbamberg]

Anyway, that's my thinking. But it's much better to have the list than not, and I could appreciate that my complaint here is pretty niche, so I won't argue with what you have here.

I'd tried several places; everywhere is a compromise - my decision to put it where it was was more about making it a level 2 heading because I wanted it in the TOC for the usual reasons.

Yes, I wish the broken ToC didn't force us into choosing between proper structure and navigability :(.