✨ [RUM-139] Add CSP trusted-types support

[mormubis]

Motivation

When a customer uses require-trusted-types-for 'script' in their CSP, two things break. The compression worker fails because new Worker(url) with a plain string is blocked. The session replay recorder fails because Webpack loads lazy chunks by setting scriptElement.src = url, which is also blocked. Both produce TrustedScriptURL violations and the SDK bails out.

Fixes #3506. Jira: RUM-139.

Changes

Two fixes, one for each broken path.

For Webpack chunks: added output.trustedTypes: { policyName: 'datadog-chunks' } in webpack.base.ts. Webpack 5 has built-in support for this and handles the createPolicy / fallback logic on its own.

For the worker: added getWorkerTrustedTypePolicy() in deflateWorker.ts that creates a datadog-worker policy and wraps the URL through createScriptURL() before passing it to new Worker(). Falls back to a no-op passthrough in browsers without trusted types support.

Two separate policies are needed because Webpack creates and owns its policy internally, so we can't reuse it. And you can't create two policies with the same name by default (the spec blocks it unless allow-duplicates is in the CSP).

The third broken path from the ticket, the async CDN snippet's .src = url assignment, is not covered here. That one needs a documentation workaround rather than a code change.

Test instructions

yarn test:e2e -g "Trusted Types"

Or to test manually: start the dev server, open a page served with require-trusted-types-for 'script'; trusted-types datadog-chunks datadog-worker headers, and initialize RUM with compressIntakeRequests: true and sessionReplaySampleRate: 100. There should be no CSP violations in the console and both the worker (blob URL) and recorder chunk should load.

Checklist

• Tested locally
• Tested on staging
• Added unit tests for this change.
• Added e2e/integration tests for this change.
• Updated documentation and/or relevant AGENTS.md file

[cit-pr-commenter-54b7da]

Bundles Sizes Evolution

📦 Bundle Name	Base Size	Local Size	𝚫	𝚫%	Status
Rum	172.76 KiB	172.92 KiB	+160 B	+0.09%	✅
Rum Profiler	8.22 KiB	8.22 KiB	0 B	0.00%	✅
Rum Recorder	21.14 KiB	21.14 KiB	0 B	0.00%	✅
Logs	55.44 KiB	55.44 KiB	0 B	0.00%	✅
Rum Slim	130.87 KiB	130.87 KiB	0 B	0.00%	✅
Worker	22.96 KiB	22.96 KiB	0 B	0.00%	✅

[datadog-official]

 

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 5 Pipeline jobs failed

DataDog/browser-sdk | e2e: [chromium-pinned]     

🧪 3 Tests failed

transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › async from transport.scenario.ts  

expect(received).toBeGreaterThan(expected)

[chromium-pinned] › transport.scenario.ts:113:17 › transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › async 

    Error: expect(received).toBeGreaterThan(expected)

    Expected: > 0
    Received:   0

      116 |         .run(async ({ flushEvents, intakeRegistry }) => {
...

transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › npm from transport.scenario.ts  

expect(received).toHaveLength(expected)

[chromium-pinned] › transport.scenario.ts:113:17 › transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › npm 

    Error: expect(received).toHaveLength(expected)

    Expected length: 0
    Received length: 3
    Received array:  [{"level": "error", "message": "This document requires 'TrustedScriptURL' assignment.", "source": "console", "timestamp": 1783433350531}, {"level": "error", "message": "Datadog Browser SDK: Recorder failed to start: an error occurred while initializing the module: TypeError: Failed to set the 'src' property on 'HTMLScriptElement': This document requires 'TrustedScriptURL' assignment.
        at o.l (http://172.19.74.166:9224/app.js:1:223729)
...

View all failed tests

DataDog/browser-sdk | e2e: [chromium]     

🧪 4 Tests failed

transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › async from transport.scenario.ts  

expect(received).toBeGreaterThan(expected)

[chromium] › transport.scenario.ts:113:17 › transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › async 

    Error: expect(received).toBeGreaterThan(expected)

    Expected: > 0
    Received:   0

      116 |         .run(async ({ flushEvents, intakeRegistry }) => {
...

transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › npm from transport.scenario.ts  

expect(received).toHaveLength(expected)

[chromium] › transport.scenario.ts:113:17 › transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › npm 

    Error: expect(received).toHaveLength(expected)

    Expected length: 0
    Received length: 3
    Received array:  [{"level": "error", "message": "This document requires 'TrustedScriptURL' assignment. The action has been blocked.", "source": "console", "timestamp": 1783594134816}, {"level": "error", "message": "Datadog Browser SDK: Recorder failed to start: an error occurred while initializing the module: TypeError: Failed to set the 'src' property on 'HTMLScriptElement': This document requires 'TrustedScriptURL' assignment.
        at o.l (http://172.28.204.246:9338/app.js:1:223729)
...

View all failed tests

DataDog/browser-sdk | e2e: [firefox]     

🧪 4 Tests failed

transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › async from transport.scenario.ts  

expect(received).toBeGreaterThan(expected)

[firefox] › transport.scenario.ts:113:17 › transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › async 

    Error: expect(received).toBeGreaterThan(expected)

    Expected: > 0
    Received:   0

      116 |         .run(async ({ flushEvents, intakeRegistry }) => {
...

transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › npm from transport.scenario.ts  

expect(received).toHaveLength(expected)

[firefox] › transport.scenario.ts:113:17 › transport › data compression › Trusted Types CSP › supports Trusted Types CSP with compression worker › npm 

    Error: expect(received).toHaveLength(expected)

    Expected length: 0
    Received length: 2
    Received array:  [{"level": "error", "message": "Datadog Browser SDK: Recorder failed to start: an error occurred while initializing the module: JSHandle@object", "source": "console", "timestamp": 1783433371437}, {"level": "error", "message": "[JavaScript Error: \"Content-Security-Policy: The page’s settings blocked assigning to an injection sink because it violates the following directive: “require-trusted-types-for ’script’“\" {file: \"http://172.18.25.182:9259/app.js\" line: 1}]", "source": "console", "timestamp": 1783433371442}]

...

View all failed tests

View all 5 failed jobs.

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 71.43%
• Overall Coverage: 77.19% (-0.07%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f20814e | Docs | Datadog PR Page | Give us feedback!}