Make code compatible with Trusted Types.

[vrana]

We want to enforce Trusted Types in Dart tests and this change prepares for that. It also makes the code provably safe.

Replace this paragraph with a description of what this PR is changing or adding, and why. Consider including before/after screenshots.

List which issues are fixed by this PR. You must list at least one issue.

If you had to change anything in the flutter/tests repo, include a link to the migration guide as per the breaking change policy.

Pre-launch Checklist

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
• I read the Tree Hygiene wiki page, which explains my responsibilities.
• I read and followed the Flutter Style Guide and the C++, Objective-C, Java style guides.
• I listed at least one issue that this PR fixes in the description above.
• I added new tests to check the change I am making or feature I am adding, or Hixie said the PR is test-exempt. See testing the engine for instructions on
  writing and running engine tests.
• I updated/added relevant documentation (doc comments with ///).
• I signed the CLA.
• All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.

[flutter-dashboard]

It looks like this pull request may not have tests. Please make sure to add tests before merging. If you need an exemption to this rule, contact Hixie on the #hackers channel in Chat (don't just cc him here, he won't see it! He's on Discord!).

If you are not sure if you need tests, consider this rule of thumb: the purpose of a test is to make sure someone doesn't accidentally revert the fix. Ask yourself, is there anything in your PR that you feel it is important we not accidentally revert back to how it was before your fix?

Reviewers: Read the Tree Hygiene page and make sure this patch meets those guidelines before LGTMing.

[ditman]

Hey @vrana!

Thanks for the contribution, it must have fallen through the cracks, and we just got pinged. I worked in trusted types support in the past, and this wasn't flagged as an issue.

If you have some time for this: what's the TrustedTypes configuration I need to enable for this to fail (I've been using meta tags in my index.html so far), so I can verify the fix? (I'm pretty sure I can extend the existing tests to cover this case too)

Thanks!

[vrana]

Hey, this has been deleted by #37652. I use this META tag to enforce TT: <meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">.

[ditman]

@vrana great news, thanks for checking again!

I used required-trusted-types-for script while testing, so my guess is that my test app never hit the problematic code path (especially if it was a polyfill).

Thanks again!