RELNOTES[NEW]: Ensure more of Closure is compatible with a strict CSP…

… by default.

PiperOrigin-RevId: 432997949
Change-Id: Iba644cd6471b930d5a0d47c3e1befed0509df4b8

closure/goog/editor/contenteditablefield_test_dom.html

@@ -6,6 +6,6 @@
 -->
 <div id="parent">
 </div>
-<script>
+<script nonce="CSP+Nonce+For+Tests+Only">
   var FieldConstructor = FieldConstructor || goog.editor.Field;
 </script>

closure/goog/editor/field_test_dom.html

@@ -5,6 +5,6 @@
 See the COPYING file for details.
 -->
 <div id="parent"></div>
-<script>
+<script nonce="CSP+Nonce+For+Tests+Only">
   var FieldConstructor = goog.editor.Field;
 </script>

closure/goog/net/crossdomainrpc_test_dom.html

@@ -7,7 +7,7 @@
 <link href="crossdomainrpc_test.css?123" rel="stylesheet" type="text/css">
  <link href="crossdomainrpc_test.css#123" rel="stylesheet" type="text/css">
   <link href="crossdomainrpc_test.css" rel="stylesheet" type="text/css">
-   <script>
+   <script nonce="CSP+Nonce+For+Tests+Only">
     goog.require('goog.net.CrossDomainRpcTest');
    </script>
   </link>

closure/goog/testing/asserts_test_dom.html

@@ -10,4 +10,4 @@
 Set), so it needs polyfills. We need to fix deps.js generation to mark this as ES6, or as some new
 ES6-library language level.
 -->
-<script src="../transpile.js"></script>
+<script src="../transpile.js" nonce="CSP+Nonce+For+Tests+Only"></script>

closure/goog/tweak/tweakui.js

@@ -171,10 +171,8 @@ goog.tweak.TweakUi.createCollapsible = function(opt_domHelper) {
 
     // The following strings are for internal debugging only.  No translation
     // necessary.  Do NOT wrap goog.getMsg() around these strings.
-    var showLink =
-        dh.createDom(goog.dom.TagName.A, {href: 'javascript:;'}, 'Show Tweaks');
-    var hideLink =
-        dh.createDom(goog.dom.TagName.A, {href: 'javascript:;'}, 'Hide Tweaks');
+    var showLink = dh.createDom(goog.dom.TagName.A, {href: '#'}, 'Show Tweaks');
+    var hideLink = dh.createDom(goog.dom.TagName.A, {href: '#'}, 'Hide Tweaks');
     var ret = dh.createDom(goog.dom.TagName.DIV, null, showLink);
 
     var lazyCreate = function() {
@@ -494,10 +492,8 @@ goog.tweak.EntriesPanel.prototype.render = function(opt_endElement) {
   var ret = dh.createDom(goog.dom.TagName.DIV);
 
   var showAllDescriptionsLink = dh.createDom(
-      goog.dom.TagName.A, {
-        href: 'javascript:;',
-        onclick: goog.bind(this.toggleAllDescriptions, this)
-      },
+      goog.dom.TagName.A,
+      {href: '#', onclick: goog.bind(this.toggleAllDescriptions, this)},
       'Toggle all Descriptions');
   ret.appendChild(showAllDescriptionsLink);
 
@@ -734,9 +730,9 @@ goog.tweak.EntriesPanel.prototype.createSubPanelDom_ = function(
   'use strict';
   var dh = this.domHelper_;
   var toggleLink =
-      dh.createDom(goog.dom.TagName.A, {href: 'javascript:;'}, label + ' \xBB');
+      dh.createDom(goog.dom.TagName.A, {href: '#'}, label + ' \xBB');
   var toggleLink2 =
-      dh.createDom(goog.dom.TagName.A, {href: 'javascript:;'}, '\xAB ' + label);
+      dh.createDom(goog.dom.TagName.A, {href: '#'}, '\xAB ' + label);
   toggleLink2.style.marginRight = '10px';
 
   var innerUi = new goog.tweak.EntriesPanel(childEntries, dh);

closure/goog/ui/dialog_test.js

@@ -7,6 +7,7 @@
 goog.module('goog.ui.DialogTest');
 goog.setTestOnly();
 
+const Const = goog.require('goog.string.Const');
 const Coordinate = goog.require('goog.math.Coordinate');
 const Dialog = goog.require('goog.ui.Dialog');
 const EventType = goog.require('goog.events.EventType');
@@ -16,12 +17,14 @@ const Role = goog.require('goog.a11y.aria.Role');
 const SafeHtml = goog.require('goog.html.SafeHtml');
 const State = goog.require('goog.a11y.aria.State');
 const TagName = goog.require('goog.dom.TagName');
+const TrustedResourceUrl = goog.require('goog.html.TrustedResourceUrl');
 const aria = goog.require('goog.a11y.aria');
 const classlist = goog.require('goog.dom.classlist');
 const css3 = goog.require('goog.fx.css3');
 const dom = goog.require('goog.dom');
 const events = goog.require('goog.events');
 const recordFunction = goog.require('goog.testing.recordFunction');
+const safe = goog.require('goog.dom.safe');
 const style = goog.require('goog.style');
 const testSuite = goog.require('goog.testing.testSuite');
 const testing = goog.require('goog.html.testing');
@@ -124,25 +127,36 @@ testSuite({
       return;
     }
     dialog.setVisible(false);
-    /**
-     * @suppress {strictMissingProperties} suppression added to enable type
-     * checking
-     */
-    const iframeWindow = dom.getElement('f').contentWindow;
-    const iframeInput =
-        dom.getElementsByTagName(TagName.INPUT, iframeWindow.document)[0];
-    dialog.setButtonSet(Dialog.ButtonSet.OK);
-    const dialogElement = dialog.getElement();
-    let focusCounter = 0;
-    events.listen(dialogElement, 'focus', () => {
-      focusCounter++;
-    });
-    iframeInput.focus();
-    dialog.setVisible(true);
-    dialog.setVisible(false);
-    iframeInput.focus();
-    dialog.setVisible(true);
-    assertEquals(2, focusCounter);
+
+    const frame = dom.createDom(TagName.IFRAME);
+    safe.setIframeSrc(
+        frame, TrustedResourceUrl.fromConstant(Const.from('about:blank')));
+    try {
+      document.body.appendChild(frame);
+      /**
+       * @suppress {strictMissingProperties} suppression added to enable type
+       * checking
+       */
+      const iframeWindow = frame.contentWindow;
+      iframeWindow.document.body.appendChild(
+          iframeWindow.document.createElement('input'));
+      const iframeInput =
+          dom.getElementsByTagName(TagName.INPUT, iframeWindow.document)[0];
+      dialog.setButtonSet(Dialog.ButtonSet.OK);
+      const dialogElement = dialog.getElement();
+      let focusCounter = 0;
+      events.listen(dialogElement, 'focus', () => {
+        focusCounter++;
+      });
+      iframeInput.focus();
+      dialog.setVisible(true);
+      dialog.setVisible(false);
+      iframeInput.focus();
+      dialog.setVisible(true);
+      assertEquals(2, focusCounter);
+    } finally {
+      dom.removeNode(frame);
+    }
   },
 
   testNoDisabledButtonFocus() {

closure/goog/ui/editor/linkdialog_test.js

@@ -10,6 +10,7 @@ goog.setTestOnly();
 const AbstractDialog = goog.require('goog.ui.editor.AbstractDialog');
 const ArgumentMatcher = goog.require('goog.testing.mockmatchers.ArgumentMatcher');
 const BrowserFeature = goog.require('goog.editor.BrowserFeature');
+const Const = goog.require('goog.string.Const');
 const DomHelper = goog.require('goog.dom.DomHelper');
 const EventHandler = goog.require('goog.events.EventHandler');
 const EventType = goog.require('goog.events.EventType');
@@ -20,12 +21,14 @@ const LinkDialog = goog.require('goog.ui.editor.LinkDialog');
 const MockControl = goog.require('goog.testing.MockControl');
 const PropertyReplacer = goog.require('goog.testing.PropertyReplacer');
 const TagName = goog.require('goog.dom.TagName');
+const TrustedResourceUrl = goog.require('goog.html.TrustedResourceUrl');
 const asserts = goog.require('goog.testing.asserts');
 const dom = goog.require('goog.dom');
 const events = goog.require('goog.events');
 const googWindow = goog.require('goog.window');
 const messages = goog.require('goog.ui.editor.messages');
 const mockmatchers = goog.require('goog.testing.mockmatchers');
+const safe = goog.require('goog.dom.safe');
 const style = goog.require('goog.style');
 const testSuite = goog.require('goog.testing.testSuite');
 const testingDom = goog.require('goog.testing.dom');
@@ -297,7 +300,15 @@ testSuite({
    * checking
    */
   testShowForNewLinkWithDiffAppWindow() {
-    this.testShowForNewLink(dom.getElement('appWindowIframe').contentDocument);
+    const frame = dom.createDom(TagName.IFRAME);
+    safe.setIframeSrc(
+        frame, TrustedResourceUrl.fromConstant(Const.from('about:blank')));
+    try {
+      document.body.appendChild(frame);
+      this.testShowForNewLink(frame.contentDocument);
+    } finally {
+      dom.removeNode(frame);
+    }
   },
 
   /**

closure/goog/ui/editor/linkdialog_test_dom.html

@@ -7,6 +7,4 @@
 <link href="../../css/dialog.css" rel="stylesheet"/>
 <link href="../../css/linkbutton.css" rel="stylesheet"/>
 <link href="../../css/editor/dialog.css" rel="stylesheet"/>
-<link href="../../css/editor/linkdialog.css" rel="stylesheet"/>
-<iframe id="appWindowIframe" src="javascript:''">
-</iframe>
+<link href="../../css/editor/linkdialog.css" rel="stylesheet"/>

third_party/closure/goog/mochikit/async/deferred_async_test_dom.html

@@ -2,7 +2,7 @@
 Copyright The Closure Library Authors.
 SPDX-License-Identifier: Apache-2.0
 -->
-<script>
+<script nonce="CSP+Nonce+For+Tests+Only">
   // Required for the test. Sadly we cannot set the uncompiled/compiled defines since the actual
   // _test.html file will evaluate this after goog.async.Deferred has already been loaded, and thus
   // the default value of LONG_STACK_TRACES set. And doing this in the _test.js causes a compile