From a17e7641c07ea71c062e8fcc3c3d13f2b2261556 Mon Sep 17 00:00:00 2001 From: David Iglesias Teixeira Date: Tue, 4 Oct 2022 15:23:07 -0700 Subject: [PATCH 1/8] [web] Use TrustedTypes to load canvaskit.js --- .../src/engine/canvaskit/canvaskit_api.dart | 2 +- lib/web_ui/lib/src/engine/dom.dart | 89 ++++++++++++++++++- 2 files changed, 89 insertions(+), 2 deletions(-) diff --git a/lib/web_ui/lib/src/engine/canvaskit/canvaskit_api.dart b/lib/web_ui/lib/src/engine/canvaskit/canvaskit_api.dart index 74cd573f53f9d..c1e6003c83a6d 100644 --- a/lib/web_ui/lib/src/engine/canvaskit/canvaskit_api.dart +++ b/lib/web_ui/lib/src/engine/canvaskit/canvaskit_api.dart @@ -2652,7 +2652,7 @@ Future _downloadCanvasKitJs() { final String canvasKitJavaScriptUrl = canvasKitJavaScriptBindingsUrl; final DomHTMLScriptElement canvasKitScript = createDomHTMLScriptElement(); - canvasKitScript.src = canvasKitJavaScriptUrl; + canvasKitScript.src = createTrustedScriptUrl(canvasKitJavaScriptUrl); final Completer canvasKitLoadCompleter = Completer(); late DomEventListener callback; diff --git a/lib/web_ui/lib/src/engine/dom.dart b/lib/web_ui/lib/src/engine/dom.dart index 3ef7e820f91c7..a03508a127d3a 100644 --- a/lib/web_ui/lib/src/engine/dom.dart +++ b/lib/web_ui/lib/src/engine/dom.dart @@ -62,6 +62,7 @@ extension DomWindowExtension on DomWindow { targetOrigin, if (messagePorts != null) js_util.jsify(messagePorts) ]); + external DomTrustedTypePolicyFactory? get trustedTypes; } typedef DomRequestAnimationFrameCallback = void Function(num highResTime); @@ -516,7 +517,7 @@ extension DomHTMLImageElementExtension on DomHTMLImageElement { class DomHTMLScriptElement extends DomHTMLElement {} extension DomHTMLScriptElementExtension on DomHTMLScriptElement { - external set src(String value); + external set src(Object? /*String|TrustedScriptURL?*/ value); } DomHTMLScriptElement createDomHTMLScriptElement() => @@ -1439,6 +1440,92 @@ extension DomCSSRuleListExtension on DomCSSRuleList { js_util.getProperty(this, 'length').toInt(); } +/// Trusted Types API + +/* +// Trusted Types API (TrustedTypePolicy, TrustedScript, TrustedScriptURL) +// https://developer.mozilla.org/en-US/docs/Web/API/TrustedTypesAPI +*/ + +/// A factory to create `TrustedTypePolicy` objects. +@JS() +@staticInterop +abstract class DomTrustedTypePolicyFactory {} + +/// (Some) methods of the [DomTrustedTypePolicyFactory]: +extension DomTrustedTypePolicyFactoryExtension on DomTrustedTypePolicyFactory { + /// createPolicy + external DomTrustedTypePolicy createPolicy( + String policyName, + DomTrustedTypePolicyOptions? policyOptions, + ); +} + +/// Options to create a trusted type policy. +@JS() +@staticInterop +@anonymous +abstract class DomTrustedTypePolicyOptions { + /// Constructs a TrustedPolicyOptions object in JavaScript. + /// + /// The following properties need to be manually wrapped in [allowInterop] + /// before being passed to this constructor: [createScriptURL]. + external factory DomTrustedTypePolicyOptions({ + DomCreateScriptUrlOptionFn? createScriptURL, + }); +} + +/// Type of the function to configure createScriptURL +typedef DomCreateScriptUrlOptionFn = String? Function(String input); + +/// An instance of a TrustedTypePolicy +@JS() +@staticInterop +abstract class DomTrustedTypePolicy {} + +/// (Some) methods of the [DomTrustedTypePolicy] +extension DomTrustedTypePolicyExtension on DomTrustedTypePolicy { + /// Create a `TrustedScriptURL` for the given [input]. + external DomTrustedScriptUrl createScriptURL(String input); +} + +/// An instance of a DomTrustedScriptUrl +@JS() +@staticInterop +abstract class DomTrustedScriptUrl {} + +// The expected set of files that the flutter-engine TrustedType policy is going +// to accept as valid. +const Set _expectedFilesForTT = { + 'canvaskit.js', +}; + +// The definition of the `flutter-engine` TrustedType policy. +DomTrustedTypePolicy get _ttPolicy { + return domWindow.trustedTypes!.createPolicy('flutter-engine', + DomTrustedTypePolicyOptions( + // Validates the given [url]. + createScriptURL: allowInterop((String url) { + final Uri uri = Uri.parse(url); + if (_expectedFilesForTT.contains(uri.pathSegments.last)) { + return uri.toString(); + } + return null; + } + ))); +} + +/// Converts a String [url] into a [DomTrustedScriptUrl] object (if available). +Object? createTrustedScriptUrl(String url) { + if (domWindow.trustedTypes != null) { + // Pass `url` through Flutter Engine's TrustedType policy. + return _ttPolicy.createScriptURL(url); + } + return url; +} + +// Utility methods below + DomMessageChannel createDomMessageChannel() => domCallConstructorString('MessageChannel', [])! as DomMessageChannel; From 1488962ad2983c70139351c2f4c0778678f26adf Mon Sep 17 00:00:00 2001 From: David Iglesias Teixeira Date: Tue, 4 Oct 2022 17:37:01 -0700 Subject: [PATCH 2/8] Add unit test --- lib/web_ui/lib/src/engine/dom.dart | 23 +++++++++-- .../canvaskit/canvaskit_api_tt_on_test.dart | 38 +++++++++++++++++++ 2 files changed, 57 insertions(+), 4 deletions(-) create mode 100644 lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart diff --git a/lib/web_ui/lib/src/engine/dom.dart b/lib/web_ui/lib/src/engine/dom.dart index a03508a127d3a..eaeef32ad293b 100644 --- a/lib/web_ui/lib/src/engine/dom.dart +++ b/lib/web_ui/lib/src/engine/dom.dart @@ -73,6 +73,7 @@ class DomConsole {} extension DomConsoleExtension on DomConsole { external void warn(Object? arg); + external void error(Object? arg); } @JS('window') @@ -517,7 +518,7 @@ extension DomHTMLImageElementExtension on DomHTMLImageElement { class DomHTMLScriptElement extends DomHTMLElement {} extension DomHTMLScriptElementExtension on DomHTMLScriptElement { - external set src(Object? /*String|TrustedScriptURL?*/ value); + external set src(Object /*String|TrustedScriptURL?*/ value); } DomHTMLScriptElement createDomHTMLScriptElement() => @@ -1494,6 +1495,11 @@ extension DomTrustedTypePolicyExtension on DomTrustedTypePolicy { @staticInterop abstract class DomTrustedScriptUrl {} +/// (Some) methods of the [DomTrustedTypePolicy] +extension DomTrustedScriptUrlExtension on DomTrustedScriptUrl { + String get url => js_util.callMethod(this, 'toString', []); +} + // The expected set of files that the flutter-engine TrustedType policy is going // to accept as valid. const Set _expectedFilesForTT = { @@ -1510,16 +1516,25 @@ DomTrustedTypePolicy get _ttPolicy { if (_expectedFilesForTT.contains(uri.pathSegments.last)) { return uri.toString(); } - return null; + domWindow.console.error( + 'URL rejected by TrustedTypes policy flutter-engine: $url' + '(download prevented)'); + return null; // Ends up in JS as an empty string } ))); } /// Converts a String [url] into a [DomTrustedScriptUrl] object (if available). -Object? createTrustedScriptUrl(String url) { +Object createTrustedScriptUrl(String url) { if (domWindow.trustedTypes != null) { // Pass `url` through Flutter Engine's TrustedType policy. - return _ttPolicy.createScriptURL(url); + final DomTrustedScriptUrl trustedCanvasKitUrl = + _ttPolicy.createScriptURL(url); + + assert(trustedCanvasKitUrl.url != '', + 'URL: $url rejected by TrustedTypePolicy'); + + return trustedCanvasKitUrl; } return url; } diff --git a/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart b/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart new file mode 100644 index 0000000000000..3002349995c26 --- /dev/null +++ b/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart @@ -0,0 +1,38 @@ +// Copyright 2013 The Flutter Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +import 'package:js/js_util.dart' as js_util; + +import 'package:test/bootstrap/browser.dart'; +import 'package:test/test.dart'; +import 'package:ui/src/engine.dart'; + +import '../matchers.dart'; +import 'canvaskit_api_test.dart'; + +// These tests need to happen in a separate file, because a Content Security +// Policy cannot be relaxed once set, only made more strict. +void main() { + enableTrustedTypes(); + internalBootstrapBrowserTest(() => () { + // Run all standard canvaskit tests, with TT on... + testMain(); + + test('rejects wrong canvaskit.js URL', () async { + expect(() { + createTrustedScriptUrl('https://www.unpkg.com/soemthing/not-canvaskit.js'); + }, throwsAssertionError); + }); + }); +} + +/// Enables Trusted Types by setting the appropriate meta tag in the DOM: +/// +void enableTrustedTypes() { + print('Enabling TrustedTypes in browser window...'); + final DomHTMLMetaElement enableTTMeta = createDomHTMLMetaElement() + ..setAttribute('http-equiv', 'Content-Security-Policy') + ..content = "require-trusted-types-for 'script'"; + domDocument.head!.append(enableTTMeta); +} From 8520f89ccbc570606e962acb252db2f3d5db27e7 Mon Sep 17 00:00:00 2001 From: David Iglesias Teixeira Date: Tue, 4 Oct 2022 17:47:18 -0700 Subject: [PATCH 3/8] Skip TT test where not supported. --- lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart b/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart index 3002349995c26..ff816487e71a6 100644 --- a/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart +++ b/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart @@ -23,7 +23,7 @@ void main() { expect(() { createTrustedScriptUrl('https://www.unpkg.com/soemthing/not-canvaskit.js'); }, throwsAssertionError); - }); + }, skip: isSafari || isFirefox); }); } From 32eb60c329fc9f4bbfe8fd6b7e97e1d0e8bc9718 Mon Sep 17 00:00:00 2001 From: David Iglesias Teixeira Date: Wed, 5 Oct 2022 11:07:01 -0700 Subject: [PATCH 4/8] Remove unused import --- lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart | 2 -- 1 file changed, 2 deletions(-) diff --git a/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart b/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart index ff816487e71a6..22965ce85a841 100644 --- a/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart +++ b/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart @@ -2,8 +2,6 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -import 'package:js/js_util.dart' as js_util; - import 'package:test/bootstrap/browser.dart'; import 'package:test/test.dart'; import 'package:ui/src/engine.dart'; From 06d44455b0213da2b698a74ce92cd5fe673bc1c4 Mon Sep 17 00:00:00 2001 From: David Iglesias Teixeira Date: Tue, 18 Oct 2022 16:00:59 -0700 Subject: [PATCH 5/8] Address PR comments. --- lib/web_ui/lib/src/engine/dom.dart | 90 ++++++++++++++++++++---------- 1 file changed, 60 insertions(+), 30 deletions(-) diff --git a/lib/web_ui/lib/src/engine/dom.dart b/lib/web_ui/lib/src/engine/dom.dart index eaeef32ad293b..12d5c80faab69 100644 --- a/lib/web_ui/lib/src/engine/dom.dart +++ b/lib/web_ui/lib/src/engine/dom.dart @@ -62,6 +62,9 @@ extension DomWindowExtension on DomWindow { targetOrigin, if (messagePorts != null) js_util.jsify(messagePorts) ]); + + /// The Trusted Types API (when available). + /// See: https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API external DomTrustedTypePolicyFactory? get trustedTypes; } @@ -518,7 +521,7 @@ extension DomHTMLImageElementExtension on DomHTMLImageElement { class DomHTMLScriptElement extends DomHTMLElement {} extension DomHTMLScriptElementExtension on DomHTMLScriptElement { - external set src(Object /*String|TrustedScriptURL?*/ value); + external set src(Object /* String|TrustedScriptURL */ value); } DomHTMLScriptElement createDomHTMLScriptElement() => @@ -1441,21 +1444,16 @@ extension DomCSSRuleListExtension on DomCSSRuleList { js_util.getProperty(this, 'length').toInt(); } -/// Trusted Types API - -/* -// Trusted Types API (TrustedTypePolicy, TrustedScript, TrustedScriptURL) -// https://developer.mozilla.org/en-US/docs/Web/API/TrustedTypesAPI -*/ - /// A factory to create `TrustedTypePolicy` objects. +/// See: https://developer.mozilla.org/en-US/docs/Web/API/TrustedTypePolicyFactory @JS() @staticInterop abstract class DomTrustedTypePolicyFactory {} -/// (Some) methods of the [DomTrustedTypePolicyFactory]: +/// A subset of TrustedTypePolicyFactory methods. extension DomTrustedTypePolicyFactoryExtension on DomTrustedTypePolicyFactory { - /// createPolicy + /// Creates a TrustedTypePolicy object named `policyName` that implements the + /// rules passed as `policyOptions`. external DomTrustedTypePolicy createPolicy( String policyName, DomTrustedTypePolicyOptions? policyOptions, @@ -1463,11 +1461,19 @@ extension DomTrustedTypePolicyFactoryExtension on DomTrustedTypePolicyFactory { } /// Options to create a trusted type policy. +/// +/// The options are user-defined functions for converting strings into trusted +/// values. +/// +/// See: https://developer.mozilla.org/en-US/docs/Web/API/TrustedTypePolicyFactory/createPolicy#policyoptions @JS() @staticInterop @anonymous abstract class DomTrustedTypePolicyOptions { - /// Constructs a TrustedPolicyOptions object in JavaScript. + /// Constructs a TrustedTypePolicyOptions object in JavaScript. + /// + /// `createScriptURL` is a callback function that contains code to run when + /// creating a TrustedScriptURL object. /// /// The following properties need to be manually wrapped in [allowInterop] /// before being passed to this constructor: [createScriptURL]. @@ -1476,27 +1482,46 @@ abstract class DomTrustedTypePolicyOptions { }); } -/// Type of the function to configure createScriptURL +/// Type of the function to configure createScriptURL. typedef DomCreateScriptUrlOptionFn = String? Function(String input); -/// An instance of a TrustedTypePolicy +/// Dart binding of a JavaScript TrustedTypePolicy instance. +/// +/// A TrustedTypePolicy defines a group of functions which create TrustedType +/// objects. +/// +/// TrustedTypePolicy objects are created by `TrustedTypePolicyFactory.createPolicy`, +/// therefore this class has no constructor. +/// +/// See: https://developer.mozilla.org/en-US/docs/Web/API/TrustedTypePolicy @JS() @staticInterop abstract class DomTrustedTypePolicy {} -/// (Some) methods of the [DomTrustedTypePolicy] +/// A subset of TrustedTypePolicy methods. extension DomTrustedTypePolicyExtension on DomTrustedTypePolicy { - /// Create a `TrustedScriptURL` for the given [input]. - external DomTrustedScriptUrl createScriptURL(String input); + /// Creates a `TrustedScriptURL` for the given [input]. + /// + /// `input` is a string containing the data to be _sanitized_ by the policy. + external DomTrustedScriptURL createScriptURL(String input); } -/// An instance of a DomTrustedScriptUrl +/// Dart binding of a JavaScript TrustedScriptURL instance. +/// +/// Represents a string that a developer can insert into an _injection sink_ +/// that will parse it as an external script. +/// +/// These objects are created via `createScriptURL` and therefore have no +/// constructor. +/// +/// See: https://developer.mozilla.org/en-US/docs/Web/API/TrustedScriptURL @JS() @staticInterop -abstract class DomTrustedScriptUrl {} +abstract class DomTrustedScriptURL {} -/// (Some) methods of the [DomTrustedTypePolicy] -extension DomTrustedScriptUrlExtension on DomTrustedScriptUrl { +/// A subset of TrustedScriptURL methods. +extension DomTrustedScriptUrlExtension on DomTrustedScriptURL { + /// Exposes the `toString` JS method of TrustedScriptURL. String get url => js_util.callMethod(this, 'toString', []); } @@ -1507,8 +1532,10 @@ const Set _expectedFilesForTT = { }; // The definition of the `flutter-engine` TrustedType policy. -DomTrustedTypePolicy get _ttPolicy { - return domWindow.trustedTypes!.createPolicy('flutter-engine', +// Only accessible if the Trusted Types API is available. +final DomTrustedTypePolicy _ttPolicy = domWindow + .trustedTypes! + .createPolicy('flutter-engine', DomTrustedTypePolicyOptions( // Validates the given [url]. createScriptURL: allowInterop((String url) { @@ -1519,16 +1546,21 @@ DomTrustedTypePolicy get _ttPolicy { domWindow.console.error( 'URL rejected by TrustedTypes policy flutter-engine: $url' '(download prevented)'); - return null; // Ends up in JS as an empty string - } - ))); -} -/// Converts a String [url] into a [DomTrustedScriptUrl] object (if available). + return null; + }, + ), + ), +); + +/// Converts a String `url` into a [DomTrustedScriptURL] object, when the +/// Trusted Types API is available. +/// +/// Else returns the unmodified `url`. Object createTrustedScriptUrl(String url) { if (domWindow.trustedTypes != null) { // Pass `url` through Flutter Engine's TrustedType policy. - final DomTrustedScriptUrl trustedCanvasKitUrl = + final DomTrustedScriptURL trustedCanvasKitUrl = _ttPolicy.createScriptURL(url); assert(trustedCanvasKitUrl.url != '', @@ -1539,8 +1571,6 @@ Object createTrustedScriptUrl(String url) { return url; } -// Utility methods below - DomMessageChannel createDomMessageChannel() => domCallConstructorString('MessageChannel', [])! as DomMessageChannel; From 8e327989a16f582641714d01ce94a3fcaeea45a7 Mon Sep 17 00:00:00 2001 From: David Iglesias Teixeira Date: Tue, 18 Oct 2022 16:04:59 -0700 Subject: [PATCH 6/8] dart format (TrustedTypes) --- lib/web_ui/lib/src/engine/dom.dart | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/lib/web_ui/lib/src/engine/dom.dart b/lib/web_ui/lib/src/engine/dom.dart index 12d5c80faab69..40aa20beb5f14 100644 --- a/lib/web_ui/lib/src/engine/dom.dart +++ b/lib/web_ui/lib/src/engine/dom.dart @@ -1533,19 +1533,19 @@ const Set _expectedFilesForTT = { // The definition of the `flutter-engine` TrustedType policy. // Only accessible if the Trusted Types API is available. -final DomTrustedTypePolicy _ttPolicy = domWindow - .trustedTypes! - .createPolicy('flutter-engine', - DomTrustedTypePolicyOptions( - // Validates the given [url]. - createScriptURL: allowInterop((String url) { +final DomTrustedTypePolicy _ttPolicy = domWindow.trustedTypes!.createPolicy( + 'flutter-engine', + DomTrustedTypePolicyOptions( + // Validates the given [url]. + createScriptURL: allowInterop( + (String url) { final Uri uri = Uri.parse(url); if (_expectedFilesForTT.contains(uri.pathSegments.last)) { return uri.toString(); } - domWindow.console.error( - 'URL rejected by TrustedTypes policy flutter-engine: $url' - '(download prevented)'); + domWindow.console + .error('URL rejected by TrustedTypes policy flutter-engine: $url' + '(download prevented)'); return null; }, @@ -1561,10 +1561,10 @@ Object createTrustedScriptUrl(String url) { if (domWindow.trustedTypes != null) { // Pass `url` through Flutter Engine's TrustedType policy. final DomTrustedScriptURL trustedCanvasKitUrl = - _ttPolicy.createScriptURL(url); + _ttPolicy.createScriptURL(url); assert(trustedCanvasKitUrl.url != '', - 'URL: $url rejected by TrustedTypePolicy'); + 'URL: $url rejected by TrustedTypePolicy'); return trustedCanvasKitUrl; } From f7a3494760ae842250b89e827f549be77c11c122 Mon Sep 17 00:00:00 2001 From: David Iglesias Teixeira Date: Tue, 18 Oct 2022 16:36:48 -0700 Subject: [PATCH 7/8] Add more tests. --- .../canvaskit/canvaskit_api_tt_on_test.dart | 39 +++++++++++++++---- 1 file changed, 32 insertions(+), 7 deletions(-) diff --git a/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart b/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart index 22965ce85a841..05dee0bfa6962 100644 --- a/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart +++ b/lib/web_ui/test/canvaskit/canvaskit_api_tt_on_test.dart @@ -9,20 +9,45 @@ import 'package:ui/src/engine.dart'; import '../matchers.dart'; import 'canvaskit_api_test.dart'; +final bool isBlink = browserEngine == BrowserEngine.blink; + +const String goodUrl = 'https://www.unpkg.com/blah-blah/33.x/canvaskit.js'; +const String badUrl = 'https://www.unpkg.com/soemthing/not-canvaskit.js'; + // These tests need to happen in a separate file, because a Content Security // Policy cannot be relaxed once set, only made more strict. void main() { + internalBootstrapBrowserTest(() => testMainWithTTOn); +} + +// Enables Trusted Types, runs all `canvaskit_api_test.dart`, then tests the +// createTrustedScriptUrl function. +void testMainWithTTOn() { enableTrustedTypes(); - internalBootstrapBrowserTest(() => () { - // Run all standard canvaskit tests, with TT on... - testMain(); - test('rejects wrong canvaskit.js URL', () async { + // Run all standard canvaskit tests, with TT on... + testMain(); + + group('TrustedTypes API supported', () { + test('createTrustedScriptUrl - returns TrustedScriptURL object', () async { + final Object trusted = createTrustedScriptUrl(goodUrl); + + expect(trusted, isA()); + expect((trusted as DomTrustedScriptURL).url, goodUrl); + }); + + test('createTrustedScriptUrl - rejects bad canvaskit.js URL', () async { expect(() { - createTrustedScriptUrl('https://www.unpkg.com/soemthing/not-canvaskit.js'); + createTrustedScriptUrl(badUrl); }, throwsAssertionError); - }, skip: isSafari || isFirefox); - }); + }); + }, skip: !isBlink); + + group('Trusted Types API NOT supported', () { + test('createTrustedScriptUrl - returns unmodified url', () async { + expect(createTrustedScriptUrl(badUrl), badUrl); + }); + }, skip: isBlink); } /// Enables Trusted Types by setting the appropriate meta tag in the DOM: From 4c447d9028a0881f429146a9cc75e27e1fa323cc Mon Sep 17 00:00:00 2001 From: David Iglesias Teixeira Date: Tue, 18 Oct 2022 17:34:24 -0700 Subject: [PATCH 8/8] Picking some more nits. --- lib/web_ui/lib/src/engine/dom.dart | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/lib/web_ui/lib/src/engine/dom.dart b/lib/web_ui/lib/src/engine/dom.dart index 40aa20beb5f14..466216996dc96 100644 --- a/lib/web_ui/lib/src/engine/dom.dart +++ b/lib/web_ui/lib/src/engine/dom.dart @@ -1482,11 +1482,9 @@ abstract class DomTrustedTypePolicyOptions { }); } -/// Type of the function to configure createScriptURL. +/// Type of the function used to configure createScriptURL. typedef DomCreateScriptUrlOptionFn = String? Function(String input); -/// Dart binding of a JavaScript TrustedTypePolicy instance. -/// /// A TrustedTypePolicy defines a group of functions which create TrustedType /// objects. /// @@ -1506,8 +1504,6 @@ extension DomTrustedTypePolicyExtension on DomTrustedTypePolicy { external DomTrustedScriptURL createScriptURL(String input); } -/// Dart binding of a JavaScript TrustedScriptURL instance. -/// /// Represents a string that a developer can insert into an _injection sink_ /// that will parse it as an external script. /// @@ -1553,10 +1549,8 @@ final DomTrustedTypePolicy _ttPolicy = domWindow.trustedTypes!.createPolicy( ), ); -/// Converts a String `url` into a [DomTrustedScriptURL] object, when the -/// Trusted Types API is available. -/// -/// Else returns the unmodified `url`. +/// Converts a String `url` into a [DomTrustedScriptURL] object when the +/// Trusted Types API is available, else returns the unmodified `url`. Object createTrustedScriptUrl(String url) { if (domWindow.trustedTypes != null) { // Pass `url` through Flutter Engine's TrustedType policy.