@wavemaker/angular-codegen 12.0.0-next.140534 → 12.0.0-next.141130

angular-codegen/dependencies/expression-parser.cjs.js

@@ -4975,6 +4975,45 @@ class AbstractJsEmitterVisitor extends AbstractEmitterVisitor {
         this.visitAllObjects(param => ctx.print(null, param.name), params, ctx, ',');
     }
 }
+
+/**
+ * @fileoverview
+ * A module to facilitate use of a Trusted Types policy within the JIT
+ * compiler. It lazily constructs the Trusted Types policy, providing helper
+ * utilities for promoting strings to Trusted Types. When Trusted Types are not
+ * available, strings are used as a fallback.
+ * @security All use of this module is security-sensitive and should go through
+ * security review.
+ */
+/**
+ * The Trusted Types policy, or null if Trusted Types are not
+ * enabled/supported, or undefined if the policy has not been created yet.
+ */
+let policy;
+/**
+ * Returns the Trusted Types policy, or null if Trusted Types are not
+ * enabled/supported. The first call to this function will create the policy.
+ */
+function getPolicy() {
+    if (policy === undefined) {
+        const trustedTypes = _global['trustedTypes'];
+        policy = null;
+        if (trustedTypes) {
+            try {
+                policy = trustedTypes.createPolicy('angular#unsafe-jit', {
+                    createScript: (s) => s,
+                });
+            }
+            catch {
+                // trustedTypes.createPolicy throws if called with a name that is
+                // already registered, even in report-only mode. Until the API changes,
+                // catch the error not to break the applications functionally. In such
+                // cases, the code will fall back to using strings.
+            }
+        }
+    }
+    return policy;
+}
 /**
  * Unsafely promote a string to a TrustedScript, falling back to strings when
  * Trusted Types are not available.
@@ -4983,7 +5022,7 @@ class AbstractJsEmitterVisitor extends AbstractEmitterVisitor {
  * interpreted and executed as a script by a browser, e.g. when calling eval.
  */
 function trustedScriptFromString(script) {
-    return script;
+    return getPolicy()?.createScript(script) || script;
 }
 /**
  * Unsafely call the Function constructor with the given string arguments.