1 line
52 KiB
JavaScript
1 line
52 KiB
JavaScript
["^ ","~:resource-id",["~:shadow.build.classpath/resource","goog/html/trustedresourceurl.js"],"~:js","goog.provide(\"goog.html.TrustedResourceUrl\");\ngoog.require(\"goog.asserts\");\ngoog.require(\"goog.fs.blob\");\ngoog.require(\"goog.fs.url\");\ngoog.require(\"goog.html.SafeScript\");\ngoog.require(\"goog.html.trustedtypes\");\ngoog.require(\"goog.string.Const\");\ngoog.require(\"goog.string.TypedString\");\ngoog.html.TrustedResourceUrl = class {\n constructor(value, token) {\n this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_ = token === goog.html.TrustedResourceUrl.CONSTRUCTOR_TOKEN_PRIVATE_ ? value : \"\";\n }\n toString() {\n return this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_ + \"\";\n }\n};\ngoog.html.TrustedResourceUrl.prototype.implementsGoogStringTypedString = true;\ngoog.html.TrustedResourceUrl.prototype.getTypedStringValue = function() {\n return this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_.toString();\n};\ngoog.html.TrustedResourceUrl.prototype.cloneWithParams = function(searchParams, opt_hashParams) {\n var url = goog.html.TrustedResourceUrl.unwrap(this);\n var parts = goog.html.TrustedResourceUrl.URL_PARAM_PARSER_.exec(url);\n var urlBase = parts[1];\n var urlSearch = parts[2] || \"\";\n var urlHash = parts[3] || \"\";\n return goog.html.TrustedResourceUrl.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(urlBase + goog.html.TrustedResourceUrl.stringifyParams_(\"?\", urlSearch, searchParams) + goog.html.TrustedResourceUrl.stringifyParams_(\"#\", urlHash, opt_hashParams));\n};\ngoog.html.TrustedResourceUrl.unwrap = function(trustedResourceUrl) {\n return goog.html.TrustedResourceUrl.unwrapTrustedScriptURL(trustedResourceUrl).toString();\n};\ngoog.html.TrustedResourceUrl.unwrapTrustedScriptURL = function(trustedResourceUrl) {\n if (trustedResourceUrl instanceof goog.html.TrustedResourceUrl && trustedResourceUrl.constructor === goog.html.TrustedResourceUrl) {\n return trustedResourceUrl.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_;\n } else {\n goog.asserts.fail(\"expected object of type TrustedResourceUrl, got '\" + trustedResourceUrl + \"' of type \" + goog.typeOf(trustedResourceUrl));\n return \"type_error:TrustedResourceUrl\";\n }\n};\ngoog.html.TrustedResourceUrl.format = function(format, args) {\n var formatStr = goog.string.Const.unwrap(format);\n if (!goog.html.TrustedResourceUrl.BASE_URL_.test(formatStr)) {\n throw new Error(\"Invalid TrustedResourceUrl format: \" + formatStr);\n }\n var result = formatStr.replace(goog.html.TrustedResourceUrl.FORMAT_MARKER_, function(match, id) {\n if (!Object.prototype.hasOwnProperty.call(args, id)) {\n throw new Error('Found marker, \"' + id + '\", in format string, \"' + formatStr + '\", but no valid label mapping found ' + \"in args: \" + JSON.stringify(args));\n }\n var arg = args[id];\n if (arg instanceof goog.string.Const) {\n return goog.string.Const.unwrap(arg);\n } else {\n return encodeURIComponent(String(arg));\n }\n });\n return goog.html.TrustedResourceUrl.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(result);\n};\ngoog.html.TrustedResourceUrl.FORMAT_MARKER_ = /%{(\\w+)}/g;\ngoog.html.TrustedResourceUrl.BASE_URL_ = new RegExp(\"^((https:)?//[0-9a-z.:[\\\\]-]+/\" + \"|/[^/\\\\\\\\]\" + \"|[^:/\\\\\\\\%]+/\" + \"|[^:/\\\\\\\\%]*[?#]\" + \"|about:blank#\" + \")\", \"i\");\ngoog.html.TrustedResourceUrl.URL_PARAM_PARSER_ = /^([^?#]*)(\\?[^#]*)?(#[\\s\\S]*)?/;\ngoog.html.TrustedResourceUrl.formatWithParams = function(format, args, searchParams, opt_hashParams) {\n var url = goog.html.TrustedResourceUrl.format(format, args);\n return url.cloneWithParams(searchParams, opt_hashParams);\n};\ngoog.html.TrustedResourceUrl.fromConstant = function(url) {\n return goog.html.TrustedResourceUrl.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(goog.string.Const.unwrap(url));\n};\ngoog.html.TrustedResourceUrl.fromConstants = function(parts) {\n var unwrapped = \"\";\n for (var i = 0; i < parts.length; i++) {\n unwrapped += goog.string.Const.unwrap(parts[i]);\n }\n return goog.html.TrustedResourceUrl.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(unwrapped);\n};\ngoog.html.TrustedResourceUrl.fromSafeScript = function(safeScript) {\n var blob = goog.fs.blob.getBlobWithProperties([goog.html.SafeScript.unwrap(safeScript)], \"text/javascript\");\n var url = goog.fs.url.createObjectUrl(blob);\n return goog.html.TrustedResourceUrl.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(url);\n};\ngoog.html.TrustedResourceUrl.CONSTRUCTOR_TOKEN_PRIVATE_ = {};\ngoog.html.TrustedResourceUrl.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse = function(url) {\n const noinlineUrl = url;\n const policy = goog.html.trustedtypes.getPolicyPrivateDoNotAccessOrElse();\n const value = policy ? policy.createScriptURL(noinlineUrl) : noinlineUrl;\n return new goog.html.TrustedResourceUrl(value, goog.html.TrustedResourceUrl.CONSTRUCTOR_TOKEN_PRIVATE_);\n};\ngoog.html.TrustedResourceUrl.stringifyParams_ = function(prefix, currentString, params) {\n if (params == null) {\n return currentString;\n }\n if (typeof params === \"string\") {\n return params ? prefix + encodeURIComponent(params) : \"\";\n }\n for (var key in params) {\n if (Object.prototype.hasOwnProperty.call(params, key)) {\n var value = params[key];\n var outputValues = Array.isArray(value) ? value : [value];\n for (var i = 0; i < outputValues.length; i++) {\n var outputValue = outputValues[i];\n if (outputValue != null) {\n if (!currentString) {\n currentString = prefix;\n }\n currentString += (currentString.length > prefix.length ? \"\\x26\" : \"\") + encodeURIComponent(key) + \"\\x3d\" + encodeURIComponent(String(outputValue));\n }\n }\n }\n }\n return currentString;\n};\n","~:source","/**\n * @license\n * Copyright The Closure Library Authors.\n * SPDX-License-Identifier: Apache-2.0\n */\n\n/**\n * @fileoverview The TrustedResourceUrl type and its builders.\n *\n * TODO(xtof): Link to document stating type contract.\n */\n\ngoog.provide('goog.html.TrustedResourceUrl');\n\ngoog.require('goog.asserts');\ngoog.require('goog.fs.blob');\ngoog.require('goog.fs.url');\ngoog.require('goog.html.SafeScript');\ngoog.require('goog.html.trustedtypes');\ngoog.require('goog.string.Const');\ngoog.require('goog.string.TypedString');\n\n\n\n/**\n * A URL which is under application control and from which script, CSS, and\n * other resources that represent executable code, can be fetched.\n *\n * Given that the URL can only be constructed from strings under application\n * control and is used to load resources, bugs resulting in a malformed URL\n * should not have a security impact and are likely to be easily detectable\n * during testing. Given the wide number of non-RFC compliant URLs in use,\n * stricter validation could prevent some applications from being able to use\n * this type.\n *\n * Instances of this type must be created via the factory method,\n * (`fromConstant`, `fromConstants`, `format` or `formatWithParams`), and not by\n * invoking its constructor. The constructor intentionally takes an extra\n * parameter that cannot be constructed outside of this file and the type is\n * immutable; hence only a default instance corresponding to the empty string\n * can be obtained via constructor invocation.\n *\n * Creating TrustedResourceUrl objects HAS SIDE-EFFECTS due to calling\n * Trusted Types Web API.\n *\n * @see goog.html.TrustedResourceUrl#fromConstant\n * @final\n * @struct\n * @implements {goog.string.TypedString}\n */\ngoog.html.TrustedResourceUrl = class {\n /**\n * @param {!TrustedScriptURL|string} value\n * @param {!Object} token package-internal implementation detail.\n */\n constructor(value, token) {\n /**\n * The contained value of this TrustedResourceUrl. The field has a\n * purposely ugly name to make (non-compiled) code that attempts to directly\n * access this field stand out.\n * @const\n * @private {!TrustedScriptURL|string}\n */\n this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_ =\n (token === goog.html.TrustedResourceUrl.CONSTRUCTOR_TOKEN_PRIVATE_) ?\n value :\n '';\n }\n\n /**\n * Returns a string-representation of this value.\n *\n * To obtain the actual string value wrapped in a TrustedResourceUrl, use\n * `goog.html.TrustedResourceUrl.unwrap`.\n *\n * @return {string}\n * @see goog.html.TrustedResourceUrl#unwrap\n * @override\n */\n toString() {\n return this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_ + '';\n }\n};\n\n\n/**\n * @override\n * @const\n */\ngoog.html.TrustedResourceUrl.prototype.implementsGoogStringTypedString = true;\n\n\n/**\n * Returns this TrustedResourceUrl's value as a string.\n *\n * IMPORTANT: In code where it is security relevant that an object's type is\n * indeed `TrustedResourceUrl`, use\n * `goog.html.TrustedResourceUrl.unwrap` instead of this method. If in\n * doubt, assume that it's security relevant. In particular, note that\n * goog.html functions which return a goog.html type do not guarantee that\n * the returned instance is of the right type. For example:\n *\n * <pre>\n * var fakeSafeHtml = new String('fake');\n * fakeSafeHtml.__proto__ = goog.html.SafeHtml.prototype;\n * var newSafeHtml = goog.html.SafeHtml.htmlEscape(fakeSafeHtml);\n * // newSafeHtml is just an alias for fakeSafeHtml, it's passed through by\n * // goog.html.SafeHtml.htmlEscape() as fakeSafeHtml instanceof\n * // goog.html.SafeHtml.\n * </pre>\n *\n * @see goog.html.TrustedResourceUrl#unwrap\n * @override\n */\ngoog.html.TrustedResourceUrl.prototype.getTypedStringValue = function() {\n 'use strict';\n return this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_\n .toString();\n};\n\n\n/**\n * Creates a new TrustedResourceUrl with params added to URL. Both search and\n * hash params can be specified.\n *\n * @param {string|?Object<string, *>|undefined} searchParams Search parameters\n * to add to URL. See goog.html.TrustedResourceUrl.stringifyParams_ for\n * exact format definition.\n * @param {(string|?Object<string, *>)=} opt_hashParams Hash parameters to add\n * to URL. See goog.html.TrustedResourceUrl.stringifyParams_ for exact\n * format definition.\n * @return {!goog.html.TrustedResourceUrl} New TrustedResourceUrl with params.\n */\ngoog.html.TrustedResourceUrl.prototype.cloneWithParams = function(\n searchParams, opt_hashParams) {\n 'use strict';\n var url = goog.html.TrustedResourceUrl.unwrap(this);\n var parts = goog.html.TrustedResourceUrl.URL_PARAM_PARSER_.exec(url);\n var urlBase = parts[1];\n var urlSearch = parts[2] || '';\n var urlHash = parts[3] || '';\n\n return goog.html.TrustedResourceUrl\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(\n urlBase +\n goog.html.TrustedResourceUrl.stringifyParams_(\n '?', urlSearch, searchParams) +\n goog.html.TrustedResourceUrl.stringifyParams_(\n '#', urlHash, opt_hashParams));\n};\n\n/**\n * Performs a runtime check that the provided object is indeed a\n * TrustedResourceUrl object, and returns its value.\n *\n * @param {!goog.html.TrustedResourceUrl} trustedResourceUrl The object to\n * extract from.\n * @return {string} The trustedResourceUrl object's contained string, unless\n * the run-time type check fails. In that case, `unwrap` returns an\n * innocuous string, or, if assertions are enabled, throws\n * `goog.asserts.AssertionError`.\n */\ngoog.html.TrustedResourceUrl.unwrap = function(trustedResourceUrl) {\n 'use strict';\n return goog.html.TrustedResourceUrl.unwrapTrustedScriptURL(trustedResourceUrl)\n .toString();\n};\n\n\n/**\n * Unwraps value as TrustedScriptURL if supported or as a string if not.\n * @param {!goog.html.TrustedResourceUrl} trustedResourceUrl\n * @return {!TrustedScriptURL|string}\n * @see goog.html.TrustedResourceUrl.unwrap\n */\ngoog.html.TrustedResourceUrl.unwrapTrustedScriptURL = function(\n trustedResourceUrl) {\n 'use strict';\n // Perform additional Run-time type-checking to ensure that\n // trustedResourceUrl is indeed an instance of the expected type. This\n // provides some additional protection against security bugs due to\n // application code that disables type checks.\n // Specifically, the following checks are performed:\n // 1. The object is an instance of the expected type.\n // 2. The object is not an instance of a subclass.\n if (trustedResourceUrl instanceof goog.html.TrustedResourceUrl &&\n trustedResourceUrl.constructor === goog.html.TrustedResourceUrl) {\n return trustedResourceUrl\n .privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_;\n } else {\n goog.asserts.fail('expected object of type TrustedResourceUrl, got \\'' +\n trustedResourceUrl + '\\' of type ' + goog.typeOf(trustedResourceUrl));\n return 'type_error:TrustedResourceUrl';\n }\n};\n\n\n/**\n * Creates a TrustedResourceUrl from a format string and arguments.\n *\n * The arguments for interpolation into the format string map labels to values.\n * Values of type `goog.string.Const` are interpolated without modifcation.\n * Values of other types are cast to string and encoded with\n * encodeURIComponent.\n *\n * `%{<label>}` markers are used in the format string to indicate locations\n * to be interpolated with the valued mapped to the given label. `<label>`\n * must contain only alphanumeric and `_` characters.\n *\n * The format string must match goog.html.TrustedResourceUrl.BASE_URL_.\n *\n * Example usage:\n *\n * var url = goog.html.TrustedResourceUrl.format(goog.string.Const.from(\n * 'https://www.google.com/search?q=%{query}'), {'query': searchTerm});\n *\n * var url = goog.html.TrustedResourceUrl.format(goog.string.Const.from(\n * '//www.youtube.com/v/%{videoId}?hl=en&fs=1%{autoplay}'), {\n * 'videoId': videoId,\n * 'autoplay': opt_autoplay ?\n * goog.string.Const.from('&autoplay=1') : goog.string.Const.EMPTY\n * });\n *\n * While this function can be used to create a TrustedResourceUrl from only\n * constants, fromConstant() and fromConstants() are generally preferable for\n * that purpose.\n *\n * @param {!goog.string.Const} format The format string.\n * @param {!Object<string, (string|number|!goog.string.Const)>} args Mapping\n * of labels to values to be interpolated into the format string.\n * goog.string.Const values are interpolated without encoding.\n * @return {!goog.html.TrustedResourceUrl}\n * @throws {!Error} On an invalid format string or if a label used in the\n * the format string is not present in args.\n */\ngoog.html.TrustedResourceUrl.format = function(format, args) {\n 'use strict';\n var formatStr = goog.string.Const.unwrap(format);\n if (!goog.html.TrustedResourceUrl.BASE_URL_.test(formatStr)) {\n throw new Error('Invalid TrustedResourceUrl format: ' + formatStr);\n }\n var result = formatStr.replace(\n goog.html.TrustedResourceUrl.FORMAT_MARKER_, function(match, id) {\n 'use strict';\n if (!Object.prototype.hasOwnProperty.call(args, id)) {\n throw new Error(\n 'Found marker, \"' + id + '\", in format string, \"' + formatStr +\n '\", but no valid label mapping found ' +\n 'in args: ' + JSON.stringify(args));\n }\n var arg = args[id];\n if (arg instanceof goog.string.Const) {\n return goog.string.Const.unwrap(arg);\n } else {\n return encodeURIComponent(String(arg));\n }\n });\n return goog.html.TrustedResourceUrl\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(result);\n};\n\n\n/**\n * @private @const {!RegExp}\n */\ngoog.html.TrustedResourceUrl.FORMAT_MARKER_ = /%{(\\w+)}/g;\n\n\n/**\n * The URL must be absolute, scheme-relative or path-absolute. So it must\n * start with:\n * - https:// followed by allowed origin characters.\n * - // followed by allowed origin characters.\n * - Any absolute or relative path.\n *\n * Based on\n * https://url.spec.whatwg.org/commit-snapshots/56b74ce7cca8883eab62e9a12666e2fac665d03d/#url-parsing\n * an initial / which is not followed by another / or \\ will end up in the \"path\n * state\" and from there it can only go to \"fragment state\" and \"query state\".\n *\n * We don't enforce a well-formed domain name. So '.' or '1.2' are valid.\n * That's ok because the origin comes from a compile-time constant.\n *\n * A regular expression is used instead of goog.uri for several reasons:\n * - Strictness. E.g. we don't want any userinfo component and we don't\n * want '/./, nor \\' in the first path component.\n * - Small trusted base. goog.uri is generic and might need to change,\n * reasoning about all the ways it can parse a URL now and in the future\n * is error-prone.\n * - Code size. We expect many calls to .format(), many of which might\n * not be using goog.uri.\n * - Simplicity. Using goog.uri would likely not result in simpler nor shorter\n * code.\n * @private @const {!RegExp}\n */\ngoog.html.TrustedResourceUrl.BASE_URL_ = new RegExp(\n '^((https:)?//[0-9a-z.:[\\\\]-]+/' // Origin.\n + '|/[^/\\\\\\\\]' // Absolute path.\n + '|[^:/\\\\\\\\%]+/' // Relative path.\n + '|[^:/\\\\\\\\%]*[?#]' // Query string or fragment.\n + '|about:blank#' // about:blank with fragment.\n + ')',\n 'i');\n\n/**\n * RegExp for splitting a URL into the base, search field, and hash field.\n *\n * @private @const {!RegExp}\n */\ngoog.html.TrustedResourceUrl.URL_PARAM_PARSER_ =\n /^([^?#]*)(\\?[^#]*)?(#[\\s\\S]*)?/;\n\n\n/**\n * Formats the URL same as TrustedResourceUrl.format and then adds extra URL\n * parameters.\n *\n * Example usage:\n *\n * // Creates '//www.youtube.com/v/abc?autoplay=1' for videoId='abc' and\n * // opt_autoplay=1. Creates '//www.youtube.com/v/abc' for videoId='abc'\n * // and opt_autoplay=undefined.\n * var url = goog.html.TrustedResourceUrl.formatWithParams(\n * goog.string.Const.from('//www.youtube.com/v/%{videoId}'),\n * {'videoId': videoId},\n * {'autoplay': opt_autoplay});\n *\n * @param {!goog.string.Const} format The format string.\n * @param {!Object<string, (string|number|!goog.string.Const)>} args Mapping\n * of labels to values to be interpolated into the format string.\n * goog.string.Const values are interpolated without encoding.\n * @param {string|?Object<string, *>|undefined} searchParams Parameters to add\n * to URL. See goog.html.TrustedResourceUrl.stringifyParams_ for exact\n * format definition.\n * @param {(string|?Object<string, *>)=} opt_hashParams Hash parameters to add\n * to URL. See goog.html.TrustedResourceUrl.stringifyParams_ for exact\n * format definition.\n * @return {!goog.html.TrustedResourceUrl}\n * @throws {!Error} On an invalid format string or if a label used in the\n * the format string is not present in args.\n */\ngoog.html.TrustedResourceUrl.formatWithParams = function(\n format, args, searchParams, opt_hashParams) {\n 'use strict';\n var url = goog.html.TrustedResourceUrl.format(format, args);\n return url.cloneWithParams(searchParams, opt_hashParams);\n};\n\n\n/**\n * Creates a TrustedResourceUrl object from a compile-time constant string.\n *\n * Compile-time constant strings are inherently program-controlled and hence\n * trusted.\n *\n * @param {!goog.string.Const} url A compile-time-constant string from which to\n * create a TrustedResourceUrl.\n * @return {!goog.html.TrustedResourceUrl} A TrustedResourceUrl object\n * initialized to `url`.\n */\ngoog.html.TrustedResourceUrl.fromConstant = function(url) {\n 'use strict';\n return goog.html.TrustedResourceUrl\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(\n goog.string.Const.unwrap(url));\n};\n\n\n/**\n * Creates a TrustedResourceUrl object from a compile-time constant strings.\n *\n * Compile-time constant strings are inherently program-controlled and hence\n * trusted.\n *\n * @param {!Array<!goog.string.Const>} parts Compile-time-constant strings from\n * which to create a TrustedResourceUrl.\n * @return {!goog.html.TrustedResourceUrl} A TrustedResourceUrl object\n * initialized to concatenation of `parts`.\n */\ngoog.html.TrustedResourceUrl.fromConstants = function(parts) {\n 'use strict';\n var unwrapped = '';\n for (var i = 0; i < parts.length; i++) {\n unwrapped += goog.string.Const.unwrap(parts[i]);\n }\n return goog.html.TrustedResourceUrl\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(unwrapped);\n};\n\n/**\n * Creates a TrustedResourceUrl object by generating a Blob from a SafeScript\n * object and then calling createObjectURL with that blob.\n *\n * SafeScript objects are trusted to contain executable JavaScript code.\n *\n * Caller must call goog.fs.url.revokeObjectUrl() on the unwrapped url to\n * release the underlying blob.\n *\n * Throws if browser doesn't support blob construction.\n *\n * @param {!goog.html.SafeScript} safeScript A script from which to create a\n * TrustedResourceUrl.\n * @return {!goog.html.TrustedResourceUrl} A TrustedResourceUrl object\n * initialized to a new blob URL.\n */\ngoog.html.TrustedResourceUrl.fromSafeScript = function(safeScript) {\n 'use strict';\n var blob = goog.fs.blob.getBlobWithProperties(\n [goog.html.SafeScript.unwrap(safeScript)], 'text/javascript');\n var url = goog.fs.url.createObjectUrl(blob);\n return goog.html.TrustedResourceUrl\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(url);\n};\n\n\n/**\n * Token used to ensure that object is created only from this file. No code\n * outside of this file can access this token.\n * @private {!Object}\n * @const\n */\ngoog.html.TrustedResourceUrl.CONSTRUCTOR_TOKEN_PRIVATE_ = {};\n\n\n/**\n * Package-internal utility method to create TrustedResourceUrl instances.\n *\n * @param {string} url The string to initialize the TrustedResourceUrl object\n * with.\n * @return {!goog.html.TrustedResourceUrl} The initialized TrustedResourceUrl\n * object.\n * @package\n */\ngoog.html.TrustedResourceUrl\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse = function(url) {\n 'use strict';\n /** @noinline */\n const noinlineUrl = url;\n const policy = goog.html.trustedtypes.getPolicyPrivateDoNotAccessOrElse();\n const value = policy ? policy.createScriptURL(noinlineUrl) : noinlineUrl;\n return new goog.html.TrustedResourceUrl(\n value, goog.html.TrustedResourceUrl.CONSTRUCTOR_TOKEN_PRIVATE_);\n};\n\n\n/**\n * Stringifies the passed params to be used as either a search or hash field of\n * a URL.\n *\n * @param {string} prefix The prefix character for the given field ('?' or '#').\n * @param {string} currentString The existing field value (including the prefix\n * character, if the field is present).\n * @param {string|?Object<string, *>|undefined} params The params to set or\n * append to the field.\n * - If `undefined` or `null`, the field remains unchanged.\n * - If a string, then the string will be escaped and the field will be\n * overwritten with that value.\n * - If an Object, that object is treated as a set of key-value pairs to be\n * appended to the current field. Note that JavaScript doesn't guarantee the\n * order of values in an object which might result in non-deterministic order\n * of the parameters. However, browsers currently preserve the order. The\n * rules for each entry:\n * - If an array, it will be processed as if each entry were an additional\n * parameter with exactly the same key, following the same logic below.\n * - If `undefined` or `null`, it will be skipped.\n * - Otherwise, it will be turned into a string, escaped, and appended.\n * @return {string}\n * @private\n */\ngoog.html.TrustedResourceUrl.stringifyParams_ = function(\n prefix, currentString, params) {\n 'use strict';\n if (params == null) {\n // Do not modify the field.\n return currentString;\n }\n if (typeof params === 'string') {\n // Set field to the passed string.\n return params ? prefix + encodeURIComponent(params) : '';\n }\n // Add on parameters to field from key-value object.\n for (var key in params) {\n // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/hasOwnProperty#Using_hasOwnProperty_as_a_property_name\n if (Object.prototype.hasOwnProperty.call(params, key)) {\n var value = params[key];\n var outputValues = Array.isArray(value) ? value : [value];\n for (var i = 0; i < outputValues.length; i++) {\n var outputValue = outputValues[i];\n if (outputValue != null) {\n if (!currentString) {\n currentString = prefix;\n }\n currentString += (currentString.length > prefix.length ? '&' : '') +\n encodeURIComponent(key) + '=' +\n encodeURIComponent(String(outputValue));\n }\n }\n }\n }\n return currentString;\n};\n","~:compiled-at",1684858197868,"~:source-map-json","{\n\"version\":3,\n\"file\":\"goog.html.trustedresourceurl.js\",\n\"lineCount\":111,\n\"mappings\":\"AAYAA,IAAKC,CAAAA,OAAL,CAAa,8BAAb,CAAA;AAEAD,IAAKE,CAAAA,OAAL,CAAa,cAAb,CAAA;AACAF,IAAKE,CAAAA,OAAL,CAAa,cAAb,CAAA;AACAF,IAAKE,CAAAA,OAAL,CAAa,aAAb,CAAA;AACAF,IAAKE,CAAAA,OAAL,CAAa,sBAAb,CAAA;AACAF,IAAKE,CAAAA,OAAL,CAAa,wBAAb,CAAA;AACAF,IAAKE,CAAAA,OAAL,CAAa,mBAAb,CAAA;AACAF,IAAKE,CAAAA,OAAL,CAAa,yBAAb,CAAA;AA8BAF,IAAKG,CAAAA,IAAKC,CAAAA,kBAAV,GAA+B,KAAA;AAK7BC,aAAW,CAACC,KAAD,EAAQC,KAAR,CAAe;AAQxB,QAAKC,CAAAA,uDAAL,GACKD,KAAD,KAAWP,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBK,CAAAA,0BAAxC,GACAH,KADA,GAEA,EAHJ;AARwB;AAwB1BI,UAAQ,EAAG;AACT,WAAO,IAAKF,CAAAA,uDAAZ,GAAsE,EAAtE;AADS;AA7BkB,CAA/B;AAuCAR,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBO,CAAAA,SAAUC,CAAAA,+BAAvC,GAAyE,IAAzE;AAyBAZ,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBO,CAAAA,SAAUE,CAAAA,mBAAvC,GAA6DC,QAAQ,EAAG;AAEtE,SAAO,IAAKN,CAAAA,uDACPE,CAAAA,QADE,EAAP;AAFsE,CAAxE;AAmBAV,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBO,CAAAA,SAAUI,CAAAA,eAAvC,GAAyDC,QAAQ,CAC7DC,YAD6D,EAC/CC,cAD+C,CAC/B;AAEhC,MAAIC,MAAMnB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBgB,CAAAA,MAA7B,CAAoC,IAApC,CAAV;AACA,MAAIC,QAAQrB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBkB,CAAAA,iBAAkBC,CAAAA,IAA/C,CAAoDJ,GAApD,CAAZ;AACA,MAAIK,UAAUH,KAAA,CAAM,CAAN,CAAd;AACA,MAAII,YAAYJ,KAAA,CAAM,CAAN,CAAZI,IAAwB,EAA5B;AACA,MAAIC,UAAUL,KAAA,CAAM,CAAN,CAAVK,IAAsB,EAA1B;AAEA,SAAO1B,IAAKG,CAAAA,IAAKC,CAAAA,kBACZuB,CAAAA,wDADE,CAECH,OAFD,GAGCxB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBwB,CAAAA,gBAA7B,CACI,GADJ,EACSH,SADT,EACoBR,YADpB,CAHD,GAKCjB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBwB,CAAAA,gBAA7B,CACI,GADJ,EACSF,OADT,EACkBR,cADlB,CALD,CAAP;AARgC,CADlC;AA6BAlB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBgB,CAAAA,MAA7B,GAAsCS,QAAQ,CAACC,kBAAD,CAAqB;AAEjE,SAAO9B,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmB2B,CAAAA,sBAA7B,CAAoDD,kBAApD,CACFpB,CAAAA,QADE,EAAP;AAFiE,CAAnE;AAaAV,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmB2B,CAAAA,sBAA7B,GAAsDC,QAAQ,CAC1DF,kBAD0D,CACtC;AAStB,MAAIA,kBAAJ,YAAkC9B,IAAKG,CAAAA,IAAKC,CAAAA,kBAA5C,IACI0B,kBAAmBzB,CAAAA,WADvB,KACuCL,IAAKG,CAAAA,IAAKC,CAAAA,kBADjD;AAEE,WAAO0B,kBACFtB,CAAAA,uDADL;AAFF,QAIO;AACLR,QAAKiC,CAAAA,OAAQC,CAAAA,IAAb,CAAkB,mDAAlB,GACIJ,kBADJ,GACyB,YADzB,GACyC9B,IAAKmC,CAAAA,MAAL,CAAYL,kBAAZ,CADzC,CAAA;AAEA,WAAO,+BAAP;AAHK;AAbe,CADxB;AA4DA9B,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBgC,CAAAA,MAA7B,GAAsCC,QAAQ,CAACD,MAAD,EAASE,IAAT,CAAe;AAE3D,MAAIC,YAAYvC,IAAKwC,CAAAA,MAAOC,CAAAA,KAAMrB,CAAAA,MAAlB,CAAyBgB,MAAzB,CAAhB;AACA,MAAI,CAACpC,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBsC,CAAAA,SAAUC,CAAAA,IAAvC,CAA4CJ,SAA5C,CAAL;AACE,UAAM,IAAIK,KAAJ,CAAU,qCAAV,GAAkDL,SAAlD,CAAN;AADF;AAGA,MAAIM,SAASN,SAAUO,CAAAA,OAAV,CACT9C,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmB2C,CAAAA,cADpB,EACoC,QAAQ,CAACC,KAAD,EAAQC,EAAR,CAAY;AAE/D,QAAI,CAACC,MAAOvC,CAAAA,SAAUwC,CAAAA,cAAeC,CAAAA,IAAhC,CAAqCd,IAArC,EAA2CW,EAA3C,CAAL;AACE,YAAM,IAAIL,KAAJ,CACF,iBADE,GACkBK,EADlB,GACuB,wBADvB,GACkDV,SADlD,GAEF,sCAFE,GAGF,WAHE,GAGYc,IAAKC,CAAAA,SAAL,CAAehB,IAAf,CAHZ,CAAN;AADF;AAMA,QAAIiB,MAAMjB,IAAA,CAAKW,EAAL,CAAV;AACA,QAAIM,GAAJ,YAAmBvD,IAAKwC,CAAAA,MAAOC,CAAAA,KAA/B;AACE,aAAOzC,IAAKwC,CAAAA,MAAOC,CAAAA,KAAMrB,CAAAA,MAAlB,CAAyBmC,GAAzB,CAAP;AADF;AAGE,aAAOC,kBAAA,CAAmBC,MAAA,CAAOF,GAAP,CAAnB,CAAP;AAHF;AAT+D,GADxD,CAAb;AAgBA,SAAOvD,IAAKG,CAAAA,IAAKC,CAAAA,kBACZuB,CAAAA,wDADE,CACuDkB,MADvD,CAAP;AAtB2D,CAA7D;AA8BA7C,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmB2C,CAAAA,cAA7B,GAA8C,WAA9C;AA8BA/C,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBsC,CAAAA,SAA7B,GAAyC,IAAIgB,MAAJ,CACrC,gCADqC,GAE/B,YAF+B,GAG/B,eAH+B,GAI/B,kBAJ+B,GAK/B,eAL+B,GAM/B,GAN+B,EAOrC,GAPqC,CAAzC;AAcA1D,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBkB,CAAAA,iBAA7B,GACI,gCADJ;AAgCAtB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBuD,CAAAA,gBAA7B,GAAgDC,QAAQ,CACpDxB,MADoD,EAC5CE,IAD4C,EACtCrB,YADsC,EACxBC,cADwB,CACR;AAE9C,MAAIC,MAAMnB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBgC,CAAAA,MAA7B,CAAoCA,MAApC,EAA4CE,IAA5C,CAAV;AACA,SAAOnB,GAAIJ,CAAAA,eAAJ,CAAoBE,YAApB,EAAkCC,cAAlC,CAAP;AAH8C,CADhD;AAmBAlB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmByD,CAAAA,YAA7B,GAA4CC,QAAQ,CAAC3C,GAAD,CAAM;AAExD,SAAOnB,IAAKG,CAAAA,IAAKC,CAAAA,kBACZuB,CAAAA,wDADE,CAEC3B,IAAKwC,CAAAA,MAAOC,CAAAA,KAAMrB,CAAAA,MAAlB,CAAyBD,GAAzB,CAFD,CAAP;AAFwD,CAA1D;AAmBAnB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmB2D,CAAAA,aAA7B,GAA6CC,QAAQ,CAAC3C,KAAD,CAAQ;AAE3D,MAAI4C,YAAY,EAAhB;AACA,OAAK,IAAIC,IAAI,CAAb,EAAgBA,CAAhB,GAAoB7C,KAAM8C,CAAAA,MAA1B,EAAkCD,CAAA,EAAlC;AACED,aAAA,IAAajE,IAAKwC,CAAAA,MAAOC,CAAAA,KAAMrB,CAAAA,MAAlB,CAAyBC,KAAA,CAAM6C,CAAN,CAAzB,CAAb;AADF;AAGA,SAAOlE,IAAKG,CAAAA,IAAKC,CAAAA,kBACZuB,CAAAA,wDADE,CACuDsC,SADvD,CAAP;AAN2D,CAA7D;AA0BAjE,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBgE,CAAAA,cAA7B,GAA8CC,QAAQ,CAACC,UAAD,CAAa;AAEjE,MAAIC,OAAOvE,IAAKwE,CAAAA,EAAGD,CAAAA,IAAKE,CAAAA,qBAAb,CACP,CAACzE,IAAKG,CAAAA,IAAKuE,CAAAA,UAAWtD,CAAAA,MAArB,CAA4BkD,UAA5B,CAAD,CADO,EACoC,iBADpC,CAAX;AAEA,MAAInD,MAAMnB,IAAKwE,CAAAA,EAAGrD,CAAAA,GAAIwD,CAAAA,eAAZ,CAA4BJ,IAA5B,CAAV;AACA,SAAOvE,IAAKG,CAAAA,IAAKC,CAAAA,kBACZuB,CAAAA,wDADE,CACuDR,GADvD,CAAP;AALiE,CAAnE;AAgBAnB,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBK,CAAAA,0BAA7B,GAA0D,EAA1D;AAYAT,IAAKG,CAAAA,IAAKC,CAAAA,kBACLuB,CAAAA,wDADL,GACgEiD,QAAQ,CAACzD,GAAD,CAAM;AAG5E,QAAM0D,cAAc1D,GAApB;AACA,QAAM2D,SAAS9E,IAAKG,CAAAA,IAAK4E,CAAAA,YAAaC,CAAAA,iCAAvB,EAAf;AACA,QAAM1E,QAAQwE,MAAA,GAASA,MAAOG,CAAAA,eAAP,CAAuBJ,WAAvB,CAAT,GAA+CA,WAA7D;AACA,SAAO,IAAI7E,IAAKG,CAAAA,IAAKC,CAAAA,kBAAd,CACHE,KADG,EACIN,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBK,CAAAA,0BADjC,CAAP;AAN4E,CAD9E;AAoCAT,IAAKG,CAAAA,IAAKC,CAAAA,kBAAmBwB,CAAAA,gBAA7B,GAAgDsD,QAAQ,CACpDC,MADoD,EAC5CC,aAD4C,EAC7BC,MAD6B,CACrB;AAEjC,MAAIA,MAAJ,IAAc,IAAd;AAEE,WAAOD,aAAP;AAFF;AAIA,MAAI,MAAOC,OAAX,KAAsB,QAAtB;AAEE,WAAOA,MAAA,GAASF,MAAT,GAAkB3B,kBAAA,CAAmB6B,MAAnB,CAAlB,GAA+C,EAAtD;AAFF;AAKA,OAAK,IAAIC,GAAT,GAAgBD,OAAhB;AAEE,QAAInC,MAAOvC,CAAAA,SAAUwC,CAAAA,cAAeC,CAAAA,IAAhC,CAAqCiC,MAArC,EAA6CC,GAA7C,CAAJ,CAAuD;AACrD,UAAIhF,QAAQ+E,MAAA,CAAOC,GAAP,CAAZ;AACA,UAAIC,eAAeC,KAAMC,CAAAA,OAAN,CAAcnF,KAAd,CAAA,GAAuBA,KAAvB,GAA+B,CAACA,KAAD,CAAlD;AACA,WAAK,IAAI4D,IAAI,CAAb,EAAgBA,CAAhB,GAAoBqB,YAAapB,CAAAA,MAAjC,EAAyCD,CAAA,EAAzC,CAA8C;AAC5C,YAAIwB,cAAcH,YAAA,CAAarB,CAAb,CAAlB;AACA,YAAIwB,WAAJ,IAAmB,IAAnB,CAAyB;AACvB,cAAI,CAACN,aAAL;AACEA,yBAAA,GAAgBD,MAAhB;AADF;AAGAC,uBAAA,KAAkBA,aAAcjB,CAAAA,MAAd,GAAuBgB,MAAOhB,CAAAA,MAA9B,GAAuC,MAAvC,GAA6C,EAA/D,IACIX,kBAAA,CAAmB8B,GAAnB,CADJ,GAC8B,MAD9B,GAEI9B,kBAAA,CAAmBC,MAAA,CAAOiC,WAAP,CAAnB,CAFJ;AAJuB;AAFmB;AAHO;AAFzD;AAkBA,SAAON,aAAP;AA7BiC,CADnC;;\",\n\"sources\":[\"goog/html/trustedresourceurl.js\"],\n\"sourcesContent\":[\"/**\\n * @license\\n * Copyright The Closure Library Authors.\\n * SPDX-License-Identifier: Apache-2.0\\n */\\n\\n/**\\n * @fileoverview The TrustedResourceUrl type and its builders.\\n *\\n * TODO(xtof): Link to document stating type contract.\\n */\\n\\ngoog.provide('goog.html.TrustedResourceUrl');\\n\\ngoog.require('goog.asserts');\\ngoog.require('goog.fs.blob');\\ngoog.require('goog.fs.url');\\ngoog.require('goog.html.SafeScript');\\ngoog.require('goog.html.trustedtypes');\\ngoog.require('goog.string.Const');\\ngoog.require('goog.string.TypedString');\\n\\n\\n\\n/**\\n * A URL which is under application control and from which script, CSS, and\\n * other resources that represent executable code, can be fetched.\\n *\\n * Given that the URL can only be constructed from strings under application\\n * control and is used to load resources, bugs resulting in a malformed URL\\n * should not have a security impact and are likely to be easily detectable\\n * during testing. Given the wide number of non-RFC compliant URLs in use,\\n * stricter validation could prevent some applications from being able to use\\n * this type.\\n *\\n * Instances of this type must be created via the factory method,\\n * (`fromConstant`, `fromConstants`, `format` or `formatWithParams`), and not by\\n * invoking its constructor. The constructor intentionally takes an extra\\n * parameter that cannot be constructed outside of this file and the type is\\n * immutable; hence only a default instance corresponding to the empty string\\n * can be obtained via constructor invocation.\\n *\\n * Creating TrustedResourceUrl objects HAS SIDE-EFFECTS due to calling\\n * Trusted Types Web API.\\n *\\n * @see goog.html.TrustedResourceUrl#fromConstant\\n * @final\\n * @struct\\n * @implements {goog.string.TypedString}\\n */\\ngoog.html.TrustedResourceUrl = class {\\n /**\\n * @param {!TrustedScriptURL|string} value\\n * @param {!Object} token package-internal implementation detail.\\n */\\n constructor(value, token) {\\n /**\\n * The contained value of this TrustedResourceUrl. The field has a\\n * purposely ugly name to make (non-compiled) code that attempts to directly\\n * access this field stand out.\\n * @const\\n * @private {!TrustedScriptURL|string}\\n */\\n this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_ =\\n (token === goog.html.TrustedResourceUrl.CONSTRUCTOR_TOKEN_PRIVATE_) ?\\n value :\\n '';\\n }\\n\\n /**\\n * Returns a string-representation of this value.\\n *\\n * To obtain the actual string value wrapped in a TrustedResourceUrl, use\\n * `goog.html.TrustedResourceUrl.unwrap`.\\n *\\n * @return {string}\\n * @see goog.html.TrustedResourceUrl#unwrap\\n * @override\\n */\\n toString() {\\n return this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_ + '';\\n }\\n};\\n\\n\\n/**\\n * @override\\n * @const\\n */\\ngoog.html.TrustedResourceUrl.prototype.implementsGoogStringTypedString = true;\\n\\n\\n/**\\n * Returns this TrustedResourceUrl's value as a string.\\n *\\n * IMPORTANT: In code where it is security relevant that an object's type is\\n * indeed `TrustedResourceUrl`, use\\n * `goog.html.TrustedResourceUrl.unwrap` instead of this method. If in\\n * doubt, assume that it's security relevant. In particular, note that\\n * goog.html functions which return a goog.html type do not guarantee that\\n * the returned instance is of the right type. For example:\\n *\\n * <pre>\\n * var fakeSafeHtml = new String('fake');\\n * fakeSafeHtml.__proto__ = goog.html.SafeHtml.prototype;\\n * var newSafeHtml = goog.html.SafeHtml.htmlEscape(fakeSafeHtml);\\n * // newSafeHtml is just an alias for fakeSafeHtml, it's passed through by\\n * // goog.html.SafeHtml.htmlEscape() as fakeSafeHtml instanceof\\n * // goog.html.SafeHtml.\\n * </pre>\\n *\\n * @see goog.html.TrustedResourceUrl#unwrap\\n * @override\\n */\\ngoog.html.TrustedResourceUrl.prototype.getTypedStringValue = function() {\\n 'use strict';\\n return this.privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_\\n .toString();\\n};\\n\\n\\n/**\\n * Creates a new TrustedResourceUrl with params added to URL. Both search and\\n * hash params can be specified.\\n *\\n * @param {string|?Object<string, *>|undefined} searchParams Search parameters\\n * to add to URL. See goog.html.TrustedResourceUrl.stringifyParams_ for\\n * exact format definition.\\n * @param {(string|?Object<string, *>)=} opt_hashParams Hash parameters to add\\n * to URL. See goog.html.TrustedResourceUrl.stringifyParams_ for exact\\n * format definition.\\n * @return {!goog.html.TrustedResourceUrl} New TrustedResourceUrl with params.\\n */\\ngoog.html.TrustedResourceUrl.prototype.cloneWithParams = function(\\n searchParams, opt_hashParams) {\\n 'use strict';\\n var url = goog.html.TrustedResourceUrl.unwrap(this);\\n var parts = goog.html.TrustedResourceUrl.URL_PARAM_PARSER_.exec(url);\\n var urlBase = parts[1];\\n var urlSearch = parts[2] || '';\\n var urlHash = parts[3] || '';\\n\\n return goog.html.TrustedResourceUrl\\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(\\n urlBase +\\n goog.html.TrustedResourceUrl.stringifyParams_(\\n '?', urlSearch, searchParams) +\\n goog.html.TrustedResourceUrl.stringifyParams_(\\n '#', urlHash, opt_hashParams));\\n};\\n\\n/**\\n * Performs a runtime check that the provided object is indeed a\\n * TrustedResourceUrl object, and returns its value.\\n *\\n * @param {!goog.html.TrustedResourceUrl} trustedResourceUrl The object to\\n * extract from.\\n * @return {string} The trustedResourceUrl object's contained string, unless\\n * the run-time type check fails. In that case, `unwrap` returns an\\n * innocuous string, or, if assertions are enabled, throws\\n * `goog.asserts.AssertionError`.\\n */\\ngoog.html.TrustedResourceUrl.unwrap = function(trustedResourceUrl) {\\n 'use strict';\\n return goog.html.TrustedResourceUrl.unwrapTrustedScriptURL(trustedResourceUrl)\\n .toString();\\n};\\n\\n\\n/**\\n * Unwraps value as TrustedScriptURL if supported or as a string if not.\\n * @param {!goog.html.TrustedResourceUrl} trustedResourceUrl\\n * @return {!TrustedScriptURL|string}\\n * @see goog.html.TrustedResourceUrl.unwrap\\n */\\ngoog.html.TrustedResourceUrl.unwrapTrustedScriptURL = function(\\n trustedResourceUrl) {\\n 'use strict';\\n // Perform additional Run-time type-checking to ensure that\\n // trustedResourceUrl is indeed an instance of the expected type. This\\n // provides some additional protection against security bugs due to\\n // application code that disables type checks.\\n // Specifically, the following checks are performed:\\n // 1. The object is an instance of the expected type.\\n // 2. The object is not an instance of a subclass.\\n if (trustedResourceUrl instanceof goog.html.TrustedResourceUrl &&\\n trustedResourceUrl.constructor === goog.html.TrustedResourceUrl) {\\n return trustedResourceUrl\\n .privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_;\\n } else {\\n goog.asserts.fail('expected object of type TrustedResourceUrl, got \\\\'' +\\n trustedResourceUrl + '\\\\' of type ' + goog.typeOf(trustedResourceUrl));\\n return 'type_error:TrustedResourceUrl';\\n }\\n};\\n\\n\\n/**\\n * Creates a TrustedResourceUrl from a format string and arguments.\\n *\\n * The arguments for interpolation into the format string map labels to values.\\n * Values of type `goog.string.Const` are interpolated without modifcation.\\n * Values of other types are cast to string and encoded with\\n * encodeURIComponent.\\n *\\n * `%{<label>}` markers are used in the format string to indicate locations\\n * to be interpolated with the valued mapped to the given label. `<label>`\\n * must contain only alphanumeric and `_` characters.\\n *\\n * The format string must match goog.html.TrustedResourceUrl.BASE_URL_.\\n *\\n * Example usage:\\n *\\n * var url = goog.html.TrustedResourceUrl.format(goog.string.Const.from(\\n * 'https://www.google.com/search?q=%{query}'), {'query': searchTerm});\\n *\\n * var url = goog.html.TrustedResourceUrl.format(goog.string.Const.from(\\n * '//www.youtube.com/v/%{videoId}?hl=en&fs=1%{autoplay}'), {\\n * 'videoId': videoId,\\n * 'autoplay': opt_autoplay ?\\n * goog.string.Const.from('&autoplay=1') : goog.string.Const.EMPTY\\n * });\\n *\\n * While this function can be used to create a TrustedResourceUrl from only\\n * constants, fromConstant() and fromConstants() are generally preferable for\\n * that purpose.\\n *\\n * @param {!goog.string.Const} format The format string.\\n * @param {!Object<string, (string|number|!goog.string.Const)>} args Mapping\\n * of labels to values to be interpolated into the format string.\\n * goog.string.Const values are interpolated without encoding.\\n * @return {!goog.html.TrustedResourceUrl}\\n * @throws {!Error} On an invalid format string or if a label used in the\\n * the format string is not present in args.\\n */\\ngoog.html.TrustedResourceUrl.format = function(format, args) {\\n 'use strict';\\n var formatStr = goog.string.Const.unwrap(format);\\n if (!goog.html.TrustedResourceUrl.BASE_URL_.test(formatStr)) {\\n throw new Error('Invalid TrustedResourceUrl format: ' + formatStr);\\n }\\n var result = formatStr.replace(\\n goog.html.TrustedResourceUrl.FORMAT_MARKER_, function(match, id) {\\n 'use strict';\\n if (!Object.prototype.hasOwnProperty.call(args, id)) {\\n throw new Error(\\n 'Found marker, \\\"' + id + '\\\", in format string, \\\"' + formatStr +\\n '\\\", but no valid label mapping found ' +\\n 'in args: ' + JSON.stringify(args));\\n }\\n var arg = args[id];\\n if (arg instanceof goog.string.Const) {\\n return goog.string.Const.unwrap(arg);\\n } else {\\n return encodeURIComponent(String(arg));\\n }\\n });\\n return goog.html.TrustedResourceUrl\\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(result);\\n};\\n\\n\\n/**\\n * @private @const {!RegExp}\\n */\\ngoog.html.TrustedResourceUrl.FORMAT_MARKER_ = /%{(\\\\w+)}/g;\\n\\n\\n/**\\n * The URL must be absolute, scheme-relative or path-absolute. So it must\\n * start with:\\n * - https:// followed by allowed origin characters.\\n * - // followed by allowed origin characters.\\n * - Any absolute or relative path.\\n *\\n * Based on\\n * https://url.spec.whatwg.org/commit-snapshots/56b74ce7cca8883eab62e9a12666e2fac665d03d/#url-parsing\\n * an initial / which is not followed by another / or \\\\ will end up in the \\\"path\\n * state\\\" and from there it can only go to \\\"fragment state\\\" and \\\"query state\\\".\\n *\\n * We don't enforce a well-formed domain name. So '.' or '1.2' are valid.\\n * That's ok because the origin comes from a compile-time constant.\\n *\\n * A regular expression is used instead of goog.uri for several reasons:\\n * - Strictness. E.g. we don't want any userinfo component and we don't\\n * want '/./, nor \\\\' in the first path component.\\n * - Small trusted base. goog.uri is generic and might need to change,\\n * reasoning about all the ways it can parse a URL now and in the future\\n * is error-prone.\\n * - Code size. We expect many calls to .format(), many of which might\\n * not be using goog.uri.\\n * - Simplicity. Using goog.uri would likely not result in simpler nor shorter\\n * code.\\n * @private @const {!RegExp}\\n */\\ngoog.html.TrustedResourceUrl.BASE_URL_ = new RegExp(\\n '^((https:)?//[0-9a-z.:[\\\\\\\\]-]+/' // Origin.\\n + '|/[^/\\\\\\\\\\\\\\\\]' // Absolute path.\\n + '|[^:/\\\\\\\\\\\\\\\\%]+/' // Relative path.\\n + '|[^:/\\\\\\\\\\\\\\\\%]*[?#]' // Query string or fragment.\\n + '|about:blank#' // about:blank with fragment.\\n + ')',\\n 'i');\\n\\n/**\\n * RegExp for splitting a URL into the base, search field, and hash field.\\n *\\n * @private @const {!RegExp}\\n */\\ngoog.html.TrustedResourceUrl.URL_PARAM_PARSER_ =\\n /^([^?#]*)(\\\\?[^#]*)?(#[\\\\s\\\\S]*)?/;\\n\\n\\n/**\\n * Formats the URL same as TrustedResourceUrl.format and then adds extra URL\\n * parameters.\\n *\\n * Example usage:\\n *\\n * // Creates '//www.youtube.com/v/abc?autoplay=1' for videoId='abc' and\\n * // opt_autoplay=1. Creates '//www.youtube.com/v/abc' for videoId='abc'\\n * // and opt_autoplay=undefined.\\n * var url = goog.html.TrustedResourceUrl.formatWithParams(\\n * goog.string.Const.from('//www.youtube.com/v/%{videoId}'),\\n * {'videoId': videoId},\\n * {'autoplay': opt_autoplay});\\n *\\n * @param {!goog.string.Const} format The format string.\\n * @param {!Object<string, (string|number|!goog.string.Const)>} args Mapping\\n * of labels to values to be interpolated into the format string.\\n * goog.string.Const values are interpolated without encoding.\\n * @param {string|?Object<string, *>|undefined} searchParams Parameters to add\\n * to URL. See goog.html.TrustedResourceUrl.stringifyParams_ for exact\\n * format definition.\\n * @param {(string|?Object<string, *>)=} opt_hashParams Hash parameters to add\\n * to URL. See goog.html.TrustedResourceUrl.stringifyParams_ for exact\\n * format definition.\\n * @return {!goog.html.TrustedResourceUrl}\\n * @throws {!Error} On an invalid format string or if a label used in the\\n * the format string is not present in args.\\n */\\ngoog.html.TrustedResourceUrl.formatWithParams = function(\\n format, args, searchParams, opt_hashParams) {\\n 'use strict';\\n var url = goog.html.TrustedResourceUrl.format(format, args);\\n return url.cloneWithParams(searchParams, opt_hashParams);\\n};\\n\\n\\n/**\\n * Creates a TrustedResourceUrl object from a compile-time constant string.\\n *\\n * Compile-time constant strings are inherently program-controlled and hence\\n * trusted.\\n *\\n * @param {!goog.string.Const} url A compile-time-constant string from which to\\n * create a TrustedResourceUrl.\\n * @return {!goog.html.TrustedResourceUrl} A TrustedResourceUrl object\\n * initialized to `url`.\\n */\\ngoog.html.TrustedResourceUrl.fromConstant = function(url) {\\n 'use strict';\\n return goog.html.TrustedResourceUrl\\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(\\n goog.string.Const.unwrap(url));\\n};\\n\\n\\n/**\\n * Creates a TrustedResourceUrl object from a compile-time constant strings.\\n *\\n * Compile-time constant strings are inherently program-controlled and hence\\n * trusted.\\n *\\n * @param {!Array<!goog.string.Const>} parts Compile-time-constant strings from\\n * which to create a TrustedResourceUrl.\\n * @return {!goog.html.TrustedResourceUrl} A TrustedResourceUrl object\\n * initialized to concatenation of `parts`.\\n */\\ngoog.html.TrustedResourceUrl.fromConstants = function(parts) {\\n 'use strict';\\n var unwrapped = '';\\n for (var i = 0; i < parts.length; i++) {\\n unwrapped += goog.string.Const.unwrap(parts[i]);\\n }\\n return goog.html.TrustedResourceUrl\\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(unwrapped);\\n};\\n\\n/**\\n * Creates a TrustedResourceUrl object by generating a Blob from a SafeScript\\n * object and then calling createObjectURL with that blob.\\n *\\n * SafeScript objects are trusted to contain executable JavaScript code.\\n *\\n * Caller must call goog.fs.url.revokeObjectUrl() on the unwrapped url to\\n * release the underlying blob.\\n *\\n * Throws if browser doesn't support blob construction.\\n *\\n * @param {!goog.html.SafeScript} safeScript A script from which to create a\\n * TrustedResourceUrl.\\n * @return {!goog.html.TrustedResourceUrl} A TrustedResourceUrl object\\n * initialized to a new blob URL.\\n */\\ngoog.html.TrustedResourceUrl.fromSafeScript = function(safeScript) {\\n 'use strict';\\n var blob = goog.fs.blob.getBlobWithProperties(\\n [goog.html.SafeScript.unwrap(safeScript)], 'text/javascript');\\n var url = goog.fs.url.createObjectUrl(blob);\\n return goog.html.TrustedResourceUrl\\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse(url);\\n};\\n\\n\\n/**\\n * Token used to ensure that object is created only from this file. No code\\n * outside of this file can access this token.\\n * @private {!Object}\\n * @const\\n */\\ngoog.html.TrustedResourceUrl.CONSTRUCTOR_TOKEN_PRIVATE_ = {};\\n\\n\\n/**\\n * Package-internal utility method to create TrustedResourceUrl instances.\\n *\\n * @param {string} url The string to initialize the TrustedResourceUrl object\\n * with.\\n * @return {!goog.html.TrustedResourceUrl} The initialized TrustedResourceUrl\\n * object.\\n * @package\\n */\\ngoog.html.TrustedResourceUrl\\n .createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse = function(url) {\\n 'use strict';\\n /** @noinline */\\n const noinlineUrl = url;\\n const policy = goog.html.trustedtypes.getPolicyPrivateDoNotAccessOrElse();\\n const value = policy ? policy.createScriptURL(noinlineUrl) : noinlineUrl;\\n return new goog.html.TrustedResourceUrl(\\n value, goog.html.TrustedResourceUrl.CONSTRUCTOR_TOKEN_PRIVATE_);\\n};\\n\\n\\n/**\\n * Stringifies the passed params to be used as either a search or hash field of\\n * a URL.\\n *\\n * @param {string} prefix The prefix character for the given field ('?' or '#').\\n * @param {string} currentString The existing field value (including the prefix\\n * character, if the field is present).\\n * @param {string|?Object<string, *>|undefined} params The params to set or\\n * append to the field.\\n * - If `undefined` or `null`, the field remains unchanged.\\n * - If a string, then the string will be escaped and the field will be\\n * overwritten with that value.\\n * - If an Object, that object is treated as a set of key-value pairs to be\\n * appended to the current field. Note that JavaScript doesn't guarantee the\\n * order of values in an object which might result in non-deterministic order\\n * of the parameters. However, browsers currently preserve the order. The\\n * rules for each entry:\\n * - If an array, it will be processed as if each entry were an additional\\n * parameter with exactly the same key, following the same logic below.\\n * - If `undefined` or `null`, it will be skipped.\\n * - Otherwise, it will be turned into a string, escaped, and appended.\\n * @return {string}\\n * @private\\n */\\ngoog.html.TrustedResourceUrl.stringifyParams_ = function(\\n prefix, currentString, params) {\\n 'use strict';\\n if (params == null) {\\n // Do not modify the field.\\n return currentString;\\n }\\n if (typeof params === 'string') {\\n // Set field to the passed string.\\n return params ? prefix + encodeURIComponent(params) : '';\\n }\\n // Add on parameters to field from key-value object.\\n for (var key in params) {\\n // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/hasOwnProperty#Using_hasOwnProperty_as_a_property_name\\n if (Object.prototype.hasOwnProperty.call(params, key)) {\\n var value = params[key];\\n var outputValues = Array.isArray(value) ? value : [value];\\n for (var i = 0; i < outputValues.length; i++) {\\n var outputValue = outputValues[i];\\n if (outputValue != null) {\\n if (!currentString) {\\n currentString = prefix;\\n }\\n currentString += (currentString.length > prefix.length ? '&' : '') +\\n encodeURIComponent(key) + '=' +\\n encodeURIComponent(String(outputValue));\\n }\\n }\\n }\\n }\\n return currentString;\\n};\\n\"],\n\"names\":[\"goog\",\"provide\",\"require\",\"html\",\"TrustedResourceUrl\",\"constructor\",\"value\",\"token\",\"privateDoNotAccessOrElseTrustedResourceUrlWrappedValue_\",\"CONSTRUCTOR_TOKEN_PRIVATE_\",\"toString\",\"prototype\",\"implementsGoogStringTypedString\",\"getTypedStringValue\",\"goog.html.TrustedResourceUrl.prototype.getTypedStringValue\",\"cloneWithParams\",\"goog.html.TrustedResourceUrl.prototype.cloneWithParams\",\"searchParams\",\"opt_hashParams\",\"url\",\"unwrap\",\"parts\",\"URL_PARAM_PARSER_\",\"exec\",\"urlBase\",\"urlSearch\",\"urlHash\",\"createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse\",\"stringifyParams_\",\"goog.html.TrustedResourceUrl.unwrap\",\"trustedResourceUrl\",\"unwrapTrustedScriptURL\",\"goog.html.TrustedResourceUrl.unwrapTrustedScriptURL\",\"asserts\",\"fail\",\"typeOf\",\"format\",\"goog.html.TrustedResourceUrl.format\",\"args\",\"formatStr\",\"string\",\"Const\",\"BASE_URL_\",\"test\",\"Error\",\"result\",\"replace\",\"FORMAT_MARKER_\",\"match\",\"id\",\"Object\",\"hasOwnProperty\",\"call\",\"JSON\",\"stringify\",\"arg\",\"encodeURIComponent\",\"String\",\"RegExp\",\"formatWithParams\",\"goog.html.TrustedResourceUrl.formatWithParams\",\"fromConstant\",\"goog.html.TrustedResourceUrl.fromConstant\",\"fromConstants\",\"goog.html.TrustedResourceUrl.fromConstants\",\"unwrapped\",\"i\",\"length\",\"fromSafeScript\",\"goog.html.TrustedResourceUrl.fromSafeScript\",\"safeScript\",\"blob\",\"fs\",\"getBlobWithProperties\",\"SafeScript\",\"createObjectUrl\",\"goog.html.TrustedResourceUrl.createTrustedResourceUrlSecurityPrivateDoNotAccessOrElse\",\"noinlineUrl\",\"policy\",\"trustedtypes\",\"getPolicyPrivateDoNotAccessOrElse\",\"createScriptURL\",\"goog.html.TrustedResourceUrl.stringifyParams_\",\"prefix\",\"currentString\",\"params\",\"key\",\"outputValues\",\"Array\",\"isArray\",\"outputValue\"]\n}\n"] |