@firebase/auth 1.7.5-canary.d752e8096 → 1.7.5-canary.f58d48cd4

package/dist/web-extension-cjs/index.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var register = require('./register-a7c7c1e6.js');
+var register = require('./register-465bb6d3.js');
 var app = require('@firebase/app');
 var util = require('@firebase/util');
 require('tslib');

package/dist/web-extension-cjs/internal.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var register = require('./register-a7c7c1e6.js');
+var register = require('./register-465bb6d3.js');
 var util = require('@firebase/util');
 var app = require('@firebase/app');
 require('tslib');
@@ -2812,6 +2812,10 @@ register._setExternalJSProvider({
         // TODO: consider adding timeout support & cancellation
         return new Promise((resolve, reject) => {
             const el = document.createElement('script');
+            // TODO: Do not use setAttribute, since it can lead to XSS. Instead, use the safevalues library to
+            // safely set an attribute for a sanitized trustedResourceUrl. Since the trustedResourceUrl
+            // must be initialized from a template string literal, this could involve some heavy
+            // refactoring.
             el.setAttribute('src', url);
             el.onload = resolve;
             el.onerror = e => {