[Medium][security] Trusted Types advertised but never wired into DOM-write sinks #171

Severity: 🟡 Medium (false security property + breaks under enforced Trusted Types)

Location

src/security/trusted-types.ts:63-69, src/security/sanitize.ts:19-33 (JSDoc claims "Uses Trusted Types when available for CSP compliance"); sinks in src/core/dom.ts, src/view/directives/html.ts:15, src/view/directives/lightweight.ts:42.

Description

sanitizeHtml returns a plain branded string; createTrustedHtml/getTrustedTypesPolicy exist but (verified by grep) are never called by any DOM-write path — only re-exported. Consequences:

• Under an enforced require-trusted-types-for 'script' CSP, every element.innerHTML = <string> / insertAdjacentHTML(<string>) in dom.ts/element.ts/collection.ts/directives throws, breaking the framework (fail-closed but non-functional).
• The documented "Trusted Types / CSP compliance" property is absent, which can mislead integrators into assuming a protection layer they do not have.

Suggested fix

Route sink writes through the policy (createTrustedHtml) when Trusted Types is supported, falling back to the string path otherwise — so sanitizeHtml output actually satisfies an enforced TT policy. Otherwise, correct the documentation to state that TT is not wired into the sinks.

Filed as part of a full-codebase security & correctness audit.