Add trusted types support

[rictic]

Description

Makes the jasmine html reporter compatible with an enforced Trusted Types policy.

This should only be necessary for a limited time, as the next version of the proposed specification will not require any special code for URLS (except javascript: URLS).

Motivation and Context

Trusted Types is a proposed extension to CSP that would allow sites to opt into stricter checks for certain DOM APIs, where the server can specify a set of policies that are allowed to create trusted values that may be used with potentially dangerous DOM APIs.

While the it is still only a proposed standard, it is a good time for authors of major libraries and frameworks to test the Trusted Types system to determine if it matches their security needs.

This change declares a policy named "jasmine" which is then used to bless the URLs that Jasmine constructs internally. A testing environment running jasmine in a recent version of Chrome that is running with the flag --enable-blink-features=TrustedDOMTypes may send CSP headers that indicate trust in the "jasmine" policy.

This code should only be necessary for a limited time, because the Trusted Types spec has recently been updated to handle anchor URLs more transparently. However I think this change will still be useful to land now, as it will enable libraries and frameworks to test with Jasmine and the current implementation that's available in Chrome today behind a flag.

More info about the proposed Trusted Types standard at https://github.com/WICG/trusted-type

How Has This Been Tested?

I've tested this end to end in Chrome 76.0.3809.87 and 77.0.3865.19 with --enable-blink-features=TrustedDOMTypes, as well as with other browsers in which this change is a no-op.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

To test this change on CI we'd need a way to send down CSP headers, and to add a Chrome with --enable-blink-features=TrustedDOMTypes to the browser matrix. I'm not familiar with configuring sauce or the rest of the jasmine CI infrastructure, but I'm happy to take direction!

Related change in Karma: karma-runner/karma#3360

[engelsdamien]

Any updates on this change ?

[rictic]

Hm, revisiting, I don't think this is necessary anymore, as the shipping version of TrustedTypes doesn't have or need the createURL function.