When csp are in the way and require you to use [trustedTypes](https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API) html

```js
var toSafeNode=(h,x=new XMLHttpRequest)=>(x.send(x.open('GET',URL.createObjectURL(new Blob([h])),0)),x.responseXML)
```
```js
var fragment = toSafeNode('<div>hej</div>')
```