@firebase/analytics 0.9.4 → 0.9.5-canary.a8d6499b1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @firebase/analytics
 
+## 0.9.5
+
+### Patch Changes
+
+- [`3435ba945`](https://github.com/firebase/firebase-js-sdk/commit/3435ba945a9febf5a0aece05517a5656f58b246f) [#7155](https://github.com/firebase/firebase-js-sdk/pull/7155) (fixes [#7048](https://github.com/firebase/firebase-js-sdk/issues/7048)) - Use the Trusted Types API when composing the gtag URL.
+
 ## 0.9.4
 
 ### Patch Changes

package/dist/esm/index.esm.js

@@ -66,6 +66,65 @@ var logger = new Logger('@firebase/analytics');
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+var _a;
+var ERRORS = (_a = {},
+    _a["already-exists" /* AnalyticsError.ALREADY_EXISTS */] = 'A Firebase Analytics instance with the appId {$id} ' +
+        ' already exists. ' +
+        'Only one Firebase Analytics instance can be created for each appId.',
+    _a["already-initialized" /* AnalyticsError.ALREADY_INITIALIZED */] = 'initializeAnalytics() cannot be called again with different options than those ' +
+        'it was initially called with. It can be called again with the same options to ' +
+        'return the existing instance, or getAnalytics() can be used ' +
+        'to get a reference to the already-intialized instance.',
+    _a["already-initialized-settings" /* AnalyticsError.ALREADY_INITIALIZED_SETTINGS */] = 'Firebase Analytics has already been initialized.' +
+        'settings() must be called before initializing any Analytics instance' +
+        'or it will have no effect.',
+    _a["interop-component-reg-failed" /* AnalyticsError.INTEROP_COMPONENT_REG_FAILED */] = 'Firebase Analytics Interop Component failed to instantiate: {$reason}',
+    _a["invalid-analytics-context" /* AnalyticsError.INVALID_ANALYTICS_CONTEXT */] = 'Firebase Analytics is not supported in this environment. ' +
+        'Wrap initialization of analytics in analytics.isSupported() ' +
+        'to prevent initialization in unsupported environments. Details: {$errorInfo}',
+    _a["indexeddb-unavailable" /* AnalyticsError.INDEXEDDB_UNAVAILABLE */] = 'IndexedDB unavailable or restricted in this environment. ' +
+        'Wrap initialization of analytics in analytics.isSupported() ' +
+        'to prevent initialization in unsupported environments. Details: {$errorInfo}',
+    _a["fetch-throttle" /* AnalyticsError.FETCH_THROTTLE */] = 'The config fetch request timed out while in an exponential backoff state.' +
+        ' Unix timestamp in milliseconds when fetch request throttling ends: {$throttleEndTimeMillis}.',
+    _a["config-fetch-failed" /* AnalyticsError.CONFIG_FETCH_FAILED */] = 'Dynamic config fetch failed: [{$httpStatus}] {$responseMessage}',
+    _a["no-api-key" /* AnalyticsError.NO_API_KEY */] = 'The "apiKey" field is empty in the local Firebase config. Firebase Analytics requires this field to' +
+        'contain a valid API key.',
+    _a["no-app-id" /* AnalyticsError.NO_APP_ID */] = 'The "appId" field is empty in the local Firebase config. Firebase Analytics requires this field to' +
+        'contain a valid app ID.',
+    _a["invalid-gtag-resource" /* AnalyticsError.INVALID_GTAG_RESOURCE */] = 'Trusted Types detected an invalid gtag resource: {$gtagURL}.',
+    _a);
+var ERROR_FACTORY = new ErrorFactory('analytics', 'Analytics', ERRORS);
+
+/**
+ * @license
+ * Copyright 2019 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Verifies and creates a TrustedScriptURL.
+ */
+function createGtagTrustedTypesScriptURL(url) {
+    if (!url.startsWith(GTAG_URL)) {
+        var err = ERROR_FACTORY.create("invalid-gtag-resource" /* AnalyticsError.INVALID_GTAG_RESOURCE */, {
+            gtagURL: url
+        });
+        logger.warn(err.message);
+        return '';
+    }
+    return url;
+}
 /**
  * Makeshift polyfill for Promise.allSettled(). Resolves when all promises
  * have either resolved or rejected.
@@ -75,15 +134,37 @@ var logger = new Logger('@firebase/analytics');
 function promiseAllSettled(promises) {
     return Promise.all(promises.map(function (promise) { return promise.catch(function (e) { return e; }); }));
 }
+/**
+ * Creates a TrustedTypePolicy object that implements the rules passed as policyOptions.
+ *
+ * @param policyName A string containing the name of the policy
+ * @param policyOptions Object containing implementations of instance methods for TrustedTypesPolicy, see {@link https://developer.mozilla.org/en-US/docs/Web/API/TrustedTypePolicy#instance_methods
+ * | the TrustedTypePolicy reference documentation}.
+ */
+function createTrustedTypesPolicy(policyName, policyOptions) {
+    // Create a TrustedTypes policy that we can use for updating src
+    // properties
+    var trustedTypesPolicy;
+    if (window.trustedTypes) {
+        trustedTypesPolicy = window.trustedTypes.createPolicy(policyName, policyOptions);
+    }
+    return trustedTypesPolicy;
+}
 /**
  * Inserts gtag script tag into the page to asynchronously download gtag.
  * @param dataLayerName Name of datalayer (most often the default, "_dataLayer").
  */
 function insertScriptTag(dataLayerName, measurementId) {
+    var trustedTypesPolicy = createTrustedTypesPolicy('firebase-js-sdk-policy', {
+        createScriptURL: createGtagTrustedTypesScriptURL
+    });
     var script = document.createElement('script');
     // We are not providing an analyticsId in the URL because it would trigger a `page_view`
     // without fid. We will initialize ga-id using gtag (config) command together with fid.
-    script.src = "".concat(GTAG_URL, "?l=").concat(dataLayerName, "&id=").concat(measurementId);
+    var gtagScriptURL = "".concat(GTAG_URL, "?l=").concat(dataLayerName, "&id=").concat(measurementId);
+    script.src = trustedTypesPolicy
+        ? trustedTypesPolicy === null || trustedTypesPolicy === void 0 ? void 0 : trustedTypesPolicy.createScriptURL(gtagScriptURL)
+        : gtagScriptURL;
     script.async = true;
     document.head.appendChild(script);
 }
@@ -344,51 +425,6 @@ function findGtagScriptOnPage(dataLayerName) {
     return null;
 }
 
-/**
- * @license
- * Copyright 2019 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-var _a;
-var ERRORS = (_a = {},
-    _a["already-exists" /* AnalyticsError.ALREADY_EXISTS */] = 'A Firebase Analytics instance with the appId {$id} ' +
-        ' already exists. ' +
-        'Only one Firebase Analytics instance can be created for each appId.',
-    _a["already-initialized" /* AnalyticsError.ALREADY_INITIALIZED */] = 'initializeAnalytics() cannot be called again with different options than those ' +
-        'it was initially called with. It can be called again with the same options to ' +
-        'return the existing instance, or getAnalytics() can be used ' +
-        'to get a reference to the already-intialized instance.',
-    _a["already-initialized-settings" /* AnalyticsError.ALREADY_INITIALIZED_SETTINGS */] = 'Firebase Analytics has already been initialized.' +
-        'settings() must be called before initializing any Analytics instance' +
-        'or it will have no effect.',
-    _a["interop-component-reg-failed" /* AnalyticsError.INTEROP_COMPONENT_REG_FAILED */] = 'Firebase Analytics Interop Component failed to instantiate: {$reason}',
-    _a["invalid-analytics-context" /* AnalyticsError.INVALID_ANALYTICS_CONTEXT */] = 'Firebase Analytics is not supported in this environment. ' +
-        'Wrap initialization of analytics in analytics.isSupported() ' +
-        'to prevent initialization in unsupported environments. Details: {$errorInfo}',
-    _a["indexeddb-unavailable" /* AnalyticsError.INDEXEDDB_UNAVAILABLE */] = 'IndexedDB unavailable or restricted in this environment. ' +
-        'Wrap initialization of analytics in analytics.isSupported() ' +
-        'to prevent initialization in unsupported environments. Details: {$errorInfo}',
-    _a["fetch-throttle" /* AnalyticsError.FETCH_THROTTLE */] = 'The config fetch request timed out while in an exponential backoff state.' +
-        ' Unix timestamp in milliseconds when fetch request throttling ends: {$throttleEndTimeMillis}.',
-    _a["config-fetch-failed" /* AnalyticsError.CONFIG_FETCH_FAILED */] = 'Dynamic config fetch failed: [{$httpStatus}] {$responseMessage}',
-    _a["no-api-key" /* AnalyticsError.NO_API_KEY */] = 'The "apiKey" field is empty in the local Firebase config. Firebase Analytics requires this field to' +
-        'contain a valid API key.',
-    _a["no-app-id" /* AnalyticsError.NO_APP_ID */] = 'The "appId" field is empty in the local Firebase config. Firebase Analytics requires this field to' +
-        'contain a valid app ID.',
-    _a);
-var ERROR_FACTORY = new ErrorFactory('analytics', 'Analytics', ERRORS);
-
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -1322,7 +1358,7 @@ function setConsent(consentSettings) {
 }
 
 var name = "@firebase/analytics";
-var version = "0.9.4";
+var version = "0.9.5-canary.a8d6499b1";
 
 /**
  * Firebase Analytics