Fix #1575: Create Trusted Type policy for assigning an HTML in detect…

…ElementResize.js (#1614) * Create Trusted Type policy for assigning an HTML Co-authored-by: Jun Kokatsu <Jun.Kokatsu@microsoft.com>
bvaughn · Dec 9, 2020 · dfc1190 · dfc1190
1 parent ff2e15c
commit dfc1190
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/source/vendor/detectElementResize.js b/source/vendor/detectElementResize.js
@@ -182,9 +182,18 @@ export default function createDetectElementResize(nonce, hostWindow) {
         element.__resizeListeners__ = [];
         (element.__resizeTriggers__ = doc.createElement('div')).className =
           'resize-triggers';
-        element.__resizeTriggers__.innerHTML =
+        var resizeTriggersHtml =
           '<div class="expand-trigger"><div></div></div>' +
           '<div class="contract-trigger"></div>';
+        if (window.trustedTypes) {
+          var staticPolicy = trustedTypes.createPolicy(
+            'react-virtualized-auto-sizer',
+            {createHTML: () => resizeTriggersHtml},
+          );
+          element.__resizeTriggers__.innerHTML = staticPolicy.createHTML('');
+        } else {
+          element.__resizeTriggers__.innerHTML = resizeTriggersHtml;
+        }
         element.appendChild(element.__resizeTriggers__);
         resetTriggers(element);
         element.addEventListener('scroll', scrollListener, true);