Security & deployment

WASM does not remove XSS: paste HTML, script gadgets, and CDN integrity still matter.

Overview

Align with Editor → Sanitization & security. If sanitization runs in Rust/WASM, keep one policy with the JS path ( Clipboard & input routing).

Content Security Policy

script-src and wasm-unsafe-eval (or nonces/hashes) affect how browsers load compiled modules. Review official docs when upgrading browsers—policies evolve.

Relaxing CSP to “make WASM work” can widen XSS—tighten around hosts you control.

SRI & module integrity

Serve WASM and JS from trusted origins; use integrity attributes where your toolchain supports them so CDN swaps are detected.

Paste & XSS with WASM sanitize

Pasted HTML is untrusted input. Whether you sanitize in JS or WASM, block scripts, javascript: URLs, and inline event handlers consistently before inserting into the DOM.

Third-party embeds

Embedding your editor in iframes or foreign sites changes COOP/COEP and worker availability—retest ( Tooling, bundle & workers).