Trusted-Types-Richtlinien-Kapselung für sichere Svelte-Kontext-Injektion

import { setContext, getContext } from 'svelte';
 
const SECURITY_KEY = Symbol('SAFE_HTML_POLICY');
 
export function createSecureHTMLContext() {
  const policy = window.trustedTypes?.createPolicy('svelte-safe-html', {
    createHTML: (string) => string.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
  });
 
  const sanitize = (rawHTML) => policy ? policy.createHTML(rawHTML) : rawHTML;
  setContext(SECURITY_KEY, { sanitize });
}
 
export function useSecureHTML() {
  const ctx = getContext(SECURITY_KEY);
  if (!ctx) throw new Error('Secure HTML context missing');
  return ctx.sanitize;
}