fix(docs-infra): fix Trusted Types violation in Analytics snippet (#42800)

The Google Analytics snippet loads its runtime by dynamically creating a
script element and assigning a URL to its src attribute. This causes a
Trusted Types violation.

To fix this, create an inline Trusted Types policy called 'aio#analytics'
to bless the script URL, which is a trusted constant.

PR Close #42800
This commit is contained in:
Bjarki
2021-07-06 01:46:00 +00:00
committed by Andrew Kushnir
parent f57f0edd23
commit b601419cd1
+6
View File
@@ -51,6 +51,12 @@
// Note this is a customised version of the GA tracking snippet
// See the comments below for more info
(function (i, s, o, g, r, a, m) {
if (i.trustedTypes) {
// Specify path as a TrustedScriptURL when Trusted Types are available
g = i.trustedTypes.createPolicy('aio#analytics', {
createScriptURL: function (s) { return s; }
}).createScriptURL(g);
}
i['GoogleAnalyticsObject'] = r; i[r] = i[r] || function () {
(i[r].q = i[r].q || []).push(arguments)
}, i[r].l = 1 * new Date(); a = s.createElement(o),