Copybara bot | be50d49 | 2023-11-30 00:16:42 +0100 | [diff] [blame] | 1 | define( [ |
| 2 | "../var/document" |
| 3 | ], function( document ) { |
| 4 | "use strict"; |
| 5 | |
| 6 | var preservedScriptAttributes = { |
| 7 | type: true, |
| 8 | src: true, |
| 9 | nonce: true, |
| 10 | noModule: true |
| 11 | }; |
| 12 | |
| 13 | function DOMEval( code, node, doc ) { |
| 14 | doc = doc || document; |
| 15 | |
| 16 | var i, val, |
| 17 | script = doc.createElement( "script" ); |
| 18 | |
| 19 | script.text = code; |
| 20 | if ( node ) { |
| 21 | for ( i in preservedScriptAttributes ) { |
| 22 | |
| 23 | // Support: Firefox 64+, Edge 18+ |
| 24 | // Some browsers don't support the "nonce" property on scripts. |
| 25 | // On the other hand, just using `getAttribute` is not enough as |
| 26 | // the `nonce` attribute is reset to an empty string whenever it |
| 27 | // becomes browsing-context connected. |
| 28 | // See https://github.com/whatwg/html/issues/2369 |
| 29 | // See https://html.spec.whatwg.org/#nonce-attributes |
| 30 | // The `node.getAttribute` check was added for the sake of |
| 31 | // `jQuery.globalEval` so that it can fake a nonce-containing node |
| 32 | // via an object. |
| 33 | val = node[ i ] || node.getAttribute && node.getAttribute( i ); |
| 34 | if ( val ) { |
| 35 | script.setAttribute( i, val ); |
| 36 | } |
| 37 | } |
| 38 | } |
| 39 | doc.head.appendChild( script ).parentNode.removeChild( script ); |
| 40 | } |
| 41 | |
| 42 | return DOMEval; |
| 43 | } ); |