TrustedTypePolicy: createScript() method
Baseline
2026
Newly available
Since February 2026, this feature works across the latest devices and browser versions. This feature might not work in older devices or browsers.
Note: This feature is available in Web Workers.
The createScript() method of the TrustedTypePolicy interface creates a TrustedScript object using a policy created by TrustedTypePolicyFactory.createPolicy().
Syntax
createScript(input)
createScript(input, args)
Parameters
input-
A string containing the string to be sanitized by the policy.
argsOptional-
Additional arguments to be passed to the function represented by
TrustedTypePolicy.
Return value
A TrustedScript object.
Exceptions
TypeError-
Thrown if
TrustedTypePolicydoes not contain a function to run on the input.
Examples
In the below example a string containing a potentially risky script is used as the input for createScript(). The policy can sanitize this script before inserting it into an injection sink that could cause it to be executed.
const sanitized = scriptPolicy.createScript("eval('2 + 2')");
Specifications
| Specification |
|---|
| Trusted Types # dom-trustedtypepolicy-createscript |