@firebase/auth 1.7.5-canary.d752e8096 → 1.7.5-canary.f58d48cd4

package/dist/browser-cjs/{index-53468b65.js → index-fd81c501.js}

@@ -10470,7 +10470,7 @@ function _isEmptyString(input) {
 }
 
 var name = "@firebase/auth";
-var version = "1.7.5-canary.d752e8096";
+var version = "1.7.5-canary.f58d48cd4";
 
 /**
  * @license
@@ -10706,6 +10706,10 @@ _setExternalJSProvider({
         // TODO: consider adding timeout support & cancellation
         return new Promise((resolve, reject) => {
             const el = document.createElement('script');
+            // TODO: Do not use setAttribute, since it can lead to XSS. Instead, use the safevalues library to
+            // safely set an attribute for a sanitized trustedResourceUrl. Since the trustedResourceUrl
+            // must be initialized from a template string literal, this could involve some heavy
+            // refactoring.
             el.setAttribute('src', url);
             el.onload = resolve;
             el.onerror = e => {
@@ -10831,4 +10835,4 @@ exports.useDeviceLanguage = useDeviceLanguage;
 exports.validatePassword = validatePassword;
 exports.verifyBeforeUpdateEmail = verifyBeforeUpdateEmail;
 exports.verifyPasswordResetCode = verifyPasswordResetCode;
-//# sourceMappingURL=index-53468b65.js.map
+//# sourceMappingURL=index-fd81c501.js.map