| 61 | * are not supported or creating the policy failed). |
| 62 | */ |
| 63 | const _createTrustedTypesPolicy = function ( |
| 64 | trustedTypes: TrustedTypePolicyFactory, |
| 65 | purifyHostElement: HTMLScriptElement |
| 66 | ) { |
| 67 | if ( |
| 68 | typeof trustedTypes !== 'object' || |
| 69 | typeof trustedTypes.createPolicy !== 'function' |
| 70 | ) { |
| 71 | return null; |
| 72 | } |
| 73 | |
| 74 | // Allow the callers to control the unique policy name |
| 75 | // by adding a data-tt-policy-suffix to the script element with the DOMPurify. |
| 76 | // Policy creation with duplicate names throws in Trusted Types. |
| 77 | let suffix = null; |
| 78 | const ATTR_NAME = 'data-tt-policy-suffix'; |
| 79 | if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) { |
| 80 | suffix = purifyHostElement.getAttribute(ATTR_NAME); |
| 81 | } |
| 82 | |
| 83 | const policyName = 'dompurify' + (suffix ? '#' + suffix : ''); |
| 84 | |
| 85 | try { |
| 86 | return trustedTypes.createPolicy(policyName, { |
| 87 | createHTML(html) { |
| 88 | return html; |
| 89 | }, |
| 90 | createScriptURL(scriptUrl) { |
| 91 | return scriptUrl; |
| 92 | }, |
| 93 | }); |
| 94 | } catch (_) { |
| 95 | // Policy creation failed (most likely another DOMPurify script has |
| 96 | // already run). Skip creating the policy, as this will only cause errors |
| 97 | // if TT are enforced. |
| 98 | console.warn( |
| 99 | 'TrustedTypes policy ' + policyName + ' could not be created.' |
| 100 | ); |
| 101 | return null; |
| 102 | } |
| 103 | }; |
| 104 | |
| 105 | const _createHooksMap = function (): HooksMap { |
| 106 | return { |