After talking with some folks about xtof's [1], I think there's something there that browsers are uniquely positioned to help out with. This patch starts sketching out what a set of safe types might look like, and what it might feel like for a developer to lock themselves out of raw string assignments to typical XSS sinks like `location.href` or `el.innerHTML`.
I don't even have an explainer yet, but the core would be something like:
```
var html = SafeHTML.escape(userProvidedString);
el.innerHTML = html;
var trusted = SafeHTML.unsafelyConstruct(developerProvidedStringOrConstant);
el.innerHTML = html;
var url = SafeURL.construct(userProvidedString);
iframe.href = url;
var trustedURL = SafeURL.unsafelyConstruct(developerProvidedStringOrConstant);
iframe.href = url;
```
With something like:
```
Content-Security-Policy: require-safe-types
```
Making direct string assignments (`el.innerHTML = "<p>Yay!</p>";`) throw `TypeError`s.
Comment 1 by bugdroid1@chromium.org
, Sep 20 2017