Add Trusted Types support to wct-mocha. (#3503)

Polymer · Apr 30, 2020 · 2f57496 · 2f57496
1 parent d897ae2
commit 2f57496
Show file tree

Hide file tree

Showing 6 changed files with 31 additions and 3 deletions.
diff --git a/packages/wct-mocha/CHANGELOG.md b/packages/wct-mocha/CHANGELOG.md
@@ -8,6 +8,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 <!-- ## Unreleased -->
 <!-- Add new, unreleased changes here. -->
 
+## 1.1.0
+* Added support for running with an enforced Trusted Types policy: https://github.com/WICG/trusted-types
+
 ## 1.0.1
 * Added support for Mocha 6.0.0, which introduced a breaking change related to initialization of stats on Mocha's test-runner, preventing reporting of test results.
 

diff --git a/packages/wct-mocha/package-lock.json b/packages/wct-mocha/package-lock.json
diff --git a/packages/wct-mocha/package.json b/packages/wct-mocha/package.json
@@ -33,7 +33,8 @@
   "repository": "github:Polymer/tools",
   "dependencies": {},
   "devDependencies": {
-    "@types/socket.io": "^1.4.36"
+    "@types/socket.io": "^1.4.36",
+    "@types/trusted-types": "^1.0.4"
   },
   "peerDependencies": {
     "mocha": "*"

diff --git a/packages/wct-mocha/src/environment.ts b/packages/wct-mocha/src/environment.ts
@@ -12,6 +12,16 @@ import * as config from './config.js';
 import * as reporters from './reporters.js';
 import * as util from './util.js';
 
+let policy = {
+  createHTML(v: string) {
+    return v;
+  }
+};
+if (window.trustedTypes) {
+  policy = window.trustedTypes.createPolicy('wct-mocha-init', policy) as
+      unknown as typeof policy;
+}
+
 /**
  * Loads all environment scripts ...synchronously ...after us.
  */
@@ -33,15 +43,17 @@ export function loadSync() {
     const url = util.expandUrl(path, config.get('root')!);
     util.debug('Loading environment script:', url);
     // Synchronous load.
-    document.write(`<script src="${encodeURI(url)}"></script>`);
+    document.write(
+        policy.createHTML(`<script src="${encodeURI(url)}"></script>`));
   });
   util.debug('Environment scripts loaded');
   const imports = config.get('environmentImports');
   imports.forEach((path) => {
     const url = util.expandUrl(path, config.get('root')!);
     util.debug('Loading environment import:', url);
     // Synchronous load.
-    document.write(`<link rel="import" href="${encodeURI(url)}">`);
+    document.write(
+        policy.createHTML(`<link rel="import" href="${encodeURI(url)}">`));
   });
   util.debug('Environment imports loaded');
 }

diff --git a/packages/wct-mocha/test/test/index.html b/packages/wct-mocha/test/test/index.html
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html>
   <body>
+    <meta http-equiv="Content-Security-Policy"
+      content="require-trusted-types-for 'script';">
     <script src="../node_modules/@webcomponents/webcomponentsjs/webcomponents-loader.js"></script>
     <script src="../node_modules/mocha/mocha.js"></script>
     <script src="../node_modules/chai/chai.js"></script>

diff --git a/packages/wct-mocha/tsconfig.json b/packages/wct-mocha/tsconfig.json
@@ -14,6 +14,10 @@
     "lib": [
       "dom",
       "es2017"
+    ],
+    "types": [
+      "trusted-types",
+      "mocha"
     ]
   },
   "exclude": [