Does GWT support CSP Trusted Types?

Hi everyone,

We're trying to implement Trusted Types (require-trusted-types-for 'script') in a GWT 2.13 application as part of CSP hardening.

We created a default Trusted Types policy, but when Trusted Types is enforced, the application fails during startup because the GWT-generated bootstrap code triggers TrustedScript/TrustedScriptURL violations.

Has anyone successfully implemented Trusted Types with GWT? Is there any official support or recommended approach for this?

Thanks in advance!

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-web-toolkit/1b60c2ba-afa2-4f3d-ad8c-251c403729adn%40googlegroups.com.

Re: Apache commons-text security issues

Hi Mirza,

this is not a production jar as Colin pointed out. 

So if you are using the owasp plugin to find these, you can safely add this library to the owasp exclusions list - or setup you plugin/project so that you only scan libraries used in your deployable product. 

rg,

Leon.

On Tuesday, 14 July 2026 at 16:45:21 UTC+2 Mirza Hadžič wrote:

Hello,

note that commons-text 1.9 used in gwt-user is having security issues,
so please upgrade this library to newer version if possible. This jar is
used by net.sourceforge.htmlunit library.

Cheers,

Mirza

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-web-toolkit/0df8389b-9106-4603-98c0-a650b2da9f3bn%40googlegroups.com.

Re: Apache commons-text security issues

Thanks for calling this out - however, the gwt-user dependency should never be on your runtime classpath, but only used when you compile/test/debug code for your project, so the scope her is limited.

Oddly, the non-maven build of GWT doesn't appear to include commons-text, I wonder if that is an oversight of the ant build, or if the dependency can simply be excluded.

I've filed https://github.com/gwtproject/gwt/issues/10370 to track this.

On Tuesday, July 14, 2026 at 9:45:21 AM UTC-5 had...@digitech.cz wrote:

Hello,

note that commons-text 1.9 used in gwt-user is having security issues,
so please upgrade this library to newer version if possible. This jar is
used by net.sourceforge.htmlunit library.

Cheers,

Mirza

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-web-toolkit/bcfd0ff7-466c-41e0-a26e-c5b2aaa97710n%40googlegroups.com.

Apache commons-text security issues

Hello, note that commons-text 1.9 used in gwt-user is having security issues, so please upgrade this library to newer version if possible. This jar is used by net.sourceforge.htmlunit library. Cheers, Mirza -- You received this message because you are subscribed to the Google Groups "GWT Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/google-web-toolkit/62b19755-f37d-4fd4-b583-39e5935b78dd%40digitech.cz.

Re: Elemental2 oddities

With the Elemental2 1.4.0-RC1 release, we now have a new WebGLContextAttributes class that now has a create method.

However, calling it:

WebGLContextAttributes contextAttributes = WebGLContextAttributes.create();

Results in:

com.google.gwt.core.client.JavaScriptException: (ReferenceError) : mOu_g$ is not defined

Which isn't what I expected.

Doing this still works:
WebGLContextAttributes contextAttributes = Js.uncheckedCast(JsPropertyMap.of());

I don't have the closure compiler knowledge to understand what's going on here.  Was the fix ( https://github.com/google/closure-compiler/issues/4250 ) not correct?

On Monday, 28 July 2025 at 8:20:37 pm UTC+10 Craig Mitchell wrote:

Thanks again Jens.  Issue raised:  https://github.com/google/closure-compiler/issues/4250

On Monday, 28 July 2025 at 6:55:23 pm UTC+10 Jens wrote:

Because it is only a dictionary (= a plain JS object)

https://registry.khronos.org/webgl/specs/latest/1.0/#5.2

In JS you simply do:

var canvas = document.getElementById('canvas');
var context = canvas.getContext('webgl', { antialias: false, stencil: true }); // 2nd argument is WebGLContextAttributes
var attributes = context.getContextAttributes();

Looks like it is again defined badly in closure-compiler externs. The generated elemental2 implementation should have a similar structure than for example elemental2 AddEventListenerOption. It is an interface with a static create() method which does exactly what you do in your solution.

See:

https://github.com/google/closure-compiler/blob/dc7f38bb0528b011984ef33a448c7941cf7e0b88/externs/browser/webgl.js#L2918

I think it should be @interface or @record instead of @constructor.

-- J.

Craig Mitchell schrieb am Montag, 28. Juli 2025 um 07:39:57 UTC+2:

I'm switching to use Elemental2, and it's fantastic.  All the bindings I'll ever need.  A big thank you to all that created it!

There are some strange things though.  Like when setting up a WebGLRenderingContext, we need to pass WebGLContextAttributes.

However, doing:

WebGLContextAttributes contextAttributes = new WebGLContextAttributes();

compiles fine, but at runtime throws:

TypeError: $wnd.WebGLContextAttributes is not a constructor

I figured out I can do this instead:

WebGLContextAttributes contextAttributes = Js.uncheckedCast(JsPropertyMap.of());

But why can't I just use its constructor?  Am I doing something wrong?

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-web-toolkit/126d9f3a-513b-4aeb-bd33-1adccce25605n%40googlegroups.com.

Re: Elemental2 WebRTC createOffer and createAnswer are incorrect

It took a year, but the newly released Elemental2 1.4.0-RC1 now has this fix.  🎉

On Wednesday, 20 August 2025 at 9:40:32 am UTC+10 Craig Mitchell wrote:

Following up on my own comment:  A request for a new build with updated closure externs has been made:  https://github.com/google/elemental2/issues/175

On Sunday, 20 July 2025 at 9:37:31 am UTC+10 Craig Mitchell wrote:

Now the good people at the closure-compiler have fixed the error ( https://github.com/google/closure-compiler/commit/5aadfa78592a2778ae4cac52613fb9238228b3e8 ), I see I can build a new version of Elemental2 locally ( https://github.com/google/elemental2?tab=readme-ov-file#build-gwt-compatible-maven-jar-files ).

It would be nice to get an offical Elemental2 build, and have it pushed to Maven.  It looks like one hasn't been done for 9 months, is there any offical Elemental2 release schedule?

On Tuesday, 15 July 2025 at 7:37:27 pm UTC+10 Craig Mitchell wrote:

Thanks Jens.  Bug raised:  https://github.com/google/closure-compiler/issues/4249

On Tuesday, 15 July 2025 at 6:49:06 pm UTC+10 Jens wrote:

And this works great.  But it would be nice to fix Elemental2.

You have to file an issue against closure-compiler because elemental2 takes their definition: https://github.com/google/closure-compiler/blob/15c5dd492cbb9dcdfd24d01f75b64e3e9b2291eb/externs/browser/w3c_rtc.js#L3586C23-L3586C44

-- J. 

--
You received this message because you are subscribed to the Google Groups "GWT Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-web-toolkit/4cb68587-ffe6-40e2-8153-6e0d56bb291bn%40googlegroups.com.

Learn more about our updated Terms of Service

vaughnjjoan@gmail.com  Every couple of years, we update our Terms of Service. We wanted to let you know ahead of time that the next update will be on July 30, 2026. These changes won’t affect the way you use our services, but they should help make it easier for you to understand what to expect from Google — and what we expect from you — as you use our services. You can review the new terms here. If you’re based in the European Economic Area (EEA) or Switzerland, we’ve also provided a summary of the key changes to the EEA version of our terms. At a glance, here’s what this update means for you: In general: We added a section to help you better understand why our services may access the internet when not actively engaged, to encourage you to check your Internet service plan and your device and network settings, as each of those may affect your costs. We updated and clarified our Settling disputes, governing law, and courts section. We make it clearer how various sections in our terms relate to each other. If you’re based in the EEA: In addition to the changes in the In general section, we updated various sections to reflect the latest EEA laws and regulations that apply to our services, including: Google’s obligation to make legally-required updates to our digital content, services, and goods. A new, online “withdrawal button” in the EEA instructions on withdrawal section. We also removed the Handling requests for your data section, because we’re centralizing our data disclosure language on our main data disclosure policy page. If you’re based outside the EEA:  In addition to the changes in the In general section, we added new disclosures and disclaimers, including ones about AI outputs. If you’re based in India, we also added new reporting language about our obligations if you violate applicable law. If you’re a parent or guardian, and you allow your child to use the services, please review the updates to our terms with your child and help them decide whether they need to make any changes to their account. Please remember that these terms apply to you and you’re responsible for your child’s activity on the services. If you don’t agree to the new terms, you should remove your content and stop using the services. You can also end your relationship with us at any time, without penalty, by closing your Google Account. Thank you for using Google services!  © 2026 Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland.  You have received this email to update you about important changes to Google’s Terms of Service.