0

I'm building an extension for Google Chat that I want to use to generate my own auto-replies instead of using the built-in suggested auto-replies. However, I seem to be running into an issue. Due to problems with XSS vulnerabilities, my environment seems to be blocking me.

// Await the response from the API upon button click
async function handleClick() {
  let textInput = document.getElementById("T2Ybvb0"); // chat bar
  const regex = /.*/i;
  const htmlPolicy = trustedTypes.createPolicy("textChange", {
    createHTML: (string) => string.replace(regex, "Test Google Chat injection"),
  });
  const trustedHTML = htmlPolicy.createHTML("<p>I love scrambled eggs!</p>");
  console.log(trustedHTML instanceof TrustedHTML);
  textInput.innerHTML = trustedHTML;
  console.log(textInput);
}

The above code is what I'm using to test a text replacement in the chat bar. trustedHTML returns true as being a type of TrustedHTML but I still can't seem to assign it to the innerHTML of textInput. Any suggestions? I was looking into DOMPurify, but I'm not exactly sure how to get it working with an import statement.

0 Answers0