GitLab

This change enables Trusted Types mitigation on WebUI by default.
It enforces use of safe API by default, and any use of unsafe API
(e.g. innerHTML, document.write, etc) has to overwrite Trusted Types
directives in the CSP header. Therefore this change makes security
review or audit of JavaScript code on WebUI a lot easier. Because
JavaScript could introduce XSS only by using
`trustedTypes.createPolicy` to generate untrusted html or script as
Trusted Types, or removing Trusted Types mitigation. And all of
those has to be carefully reviewed going forward.

Bug: 41905
Change-Id: Iba7b8f617bc00c27b22386e2f632402209c47549
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2353547Reviewed-by: Giovanni Ortuño Urquidi <ortuno@chromium.org>
Reviewed-by: John Delaney <johnidel@chromium.org>
Reviewed-by: Carlos IL <carlosil@chromium.org>
Reviewed-by: dpapad <dpapad@chromium.org>
Commit-Queue: Jun Kokatsu <Jun.Kokatsu@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#800738}