vercel/next.js

Error Overlay violates trusted types and breaks the entire app

XiupengMa opened this issue · 1 comments

XiupengMa commented

Link to the code that reproduces this issue

will share later

To Reproduce

  1. Add CSP rules to require trusted types: trusted-types: 'script'
  2. Define default CSP rules in a file: window.trustedTypes.createPolicy("default", xxx) and ensure running this file before any other application code. I tried two approaches: import it as polyfill following this example. inject it to webpack entries following this example.
  3. Intentionally introduce a hydration error to the application
  4. Run the application in dev mode.

Current vs. Expected behavior

Expected:
The hydration error modal shows up on top of the application UI.

Actual:
The application UI shows up for a second, and quickly flips to a blank page. hydration error modal doesn't show up. In the console there is such error complaining about the violation of trusted types:
image

Above it was the actual hydration error:
image

try printing out the default trusted policy we can see it's defined:
image

try adding console.log statements in the file that adds default trusted policy we can see it runs pretty early and before the hydration error was thrown.
image

image

Clicking into the error stack, it shows this .innerHTML setting statement throws the error:
image

If we fix the hydration error the application loads fine.

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.1.0: Thu Oct 10 21:03:15 PDT 2024; root:xnu-11215.41.3~2/RELEASE_ARM64_T6000
  Available memory (MB): 65536
  Available CPU cores: 10
Binaries:
  Node: 20.16.0
  npm: 10.8.1
  Yarn: 1.18.0
  pnpm: N/A
Relevant Packages:
  next: 14.2.13 // An outdated version detected (latest is 15.0.4), upgrade is highly recommended!
  eslint-config-next: 12.3.4
  react: 18.2.0
  react-dom: 18.2.0
  typescript: 4.9.3
Next.js Config:
  output: standalone
 ⚠ An outdated version detected (latest is 15.0.4), upgrade is highly recommended!
   Please try the latest canary version (`npm install next@canary`) to confirm the issue still exists before creating a new issue.
   Read more - https://nextjs.org/docs/messages/opening-an-issue

Which area(s) are affected? (Select all that apply)

Developer Experience

Which stage(s) are affected? (Select all that apply)

next dev (local)

Additional context

No response

github-actions commented

We could not detect a valid reproduction link. Make sure to follow the bug report template carefully.

Why was this issue closed?

To be able to investigate, we need access to a reproduction to identify what triggered the issue. We need a link to a public GitHub repository (template for App Router, template for Pages Router), but you can also use these templates: CodeSandbox: App Router or CodeSandbox: Pages Router.

The bug template that you filled out has a section called "Link to the code that reproduces this issue", which is where you should provide the link to the reproduction.

  • If you did not provide a link or the link you provided is not valid, we will close the issue.
  • If you provide a link to a private repository, we will close the issue.
  • If you provide a link to a repository but not in the correct section, we will close the issue.

What should I do?

Depending on the reason the issue was closed, you can do the following:

  • If you did not provide a link, please open a new issue with a link to a reproduction.
  • If you provided a link to a private repository, please open a new issue with a link to a public repository.
  • If you provided a link to a repository but not in the correct section, please open a new issue with a link to a reproduction in the correct section.

In general, assume that we should not go through a lengthy onboarding process at your company code only to be able to verify an issue.

My repository is private and cannot make it public

In most cases, a private repo will not be a sufficient minimal reproduction, as this codebase might contain a lot of unrelated parts that would make our investigation take longer. Please do not make it public. Instead, create a new repository using the templates above, adding the relevant code to reproduce the issue. Common things to look out for:

  • Remove any code that is not related to the issue. (pages, API routes, components, etc.)
  • Remove any dependencies that are not related to the issue.
  • Remove any third-party service that would require us to sign up for an account to reproduce the issue.
  • Remove any environment variables that are not related to the issue.
  • Remove private packages that we do not have access to.
  • If the issue is not related to a monorepo specifically, try to reproduce the issue without a complex monorepo setup

I did not open this issue, but it is relevant to me, what can I do to help?

Anyone experiencing the same issue is welcome to provide a minimal reproduction following the above steps by opening a new issue.

I think my reproduction is good enough, why aren't you looking into it quickly?

We look into every Next.js issue and constantly monitor open issues for new comments.

However, sometimes we might miss one or two due to the popularity/high traffic of the repository. We apologize, and kindly ask you to refrain from tagging core maintainers, as that will usually not result in increased priority.

Upvoting issues to show your interest will help us prioritize and address them as quickly as possible. That said, every issue is important to us, and if an issue gets closed by accident, we encourage you to open a new one linking to the old issue and we will look into it.

Useful Resources