From b601419cd1801fe93d2e2fb6b8e9000ada9df3c0 Mon Sep 17 00:00:00 2001 From: Bjarki Date: Tue, 6 Jul 2021 01:46:00 +0000 Subject: [PATCH] fix(docs-infra): fix Trusted Types violation in Analytics snippet (#42800) The Google Analytics snippet loads its runtime by dynamically creating a script element and assigning a URL to its src attribute. This causes a Trusted Types violation. To fix this, create an inline Trusted Types policy called 'aio#analytics' to bless the script URL, which is a trusted constant. PR Close #42800 --- aio/src/index.html | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/aio/src/index.html b/aio/src/index.html index db945765a5d..c662a01ae2d 100644 --- a/aio/src/index.html +++ b/aio/src/index.html @@ -51,6 +51,12 @@ // Note this is a customised version of the GA tracking snippet // See the comments below for more info (function (i, s, o, g, r, a, m) { + if (i.trustedTypes) { + // Specify path as a TrustedScriptURL when Trusted Types are available + g = i.trustedTypes.createPolicy('aio#analytics', { + createScriptURL: function (s) { return s; } + }).createScriptURL(g); + } i['GoogleAnalyticsObject'] = r; i[r] = i[r] || function () { (i[r].q = i[r].q || []).push(arguments) }, i[r].l = 1 * new Date(); a = s.createElement(o),