trusted-types/eval-function-constructor.html

<!DOCTYPE html>
<html>
<head>
  <script nonce="abc" src="/resources/testharness.js"></script>
  <script nonce="abc" src="/resources/testharnessreport.js"></script>
  <meta http-equiv="Content-Security-Policy"
        content="require-trusted-types-for 'script'">
</head>
<body>
<script>
  let policy = trustedTypes.createPolicy("p", { createScript: s => s });
  const args = ["a", "b", "c = 5", "return (a+b)*c;"];
  const arg_max = 2 ** args.length -1;

  // Call 'new Function(...args)', but with a subet of args being Strings,
  // and a subset being TrustedScript. We use a bitmask to determine which
  // argument gets to be trusted or not.
  function new_function_with_maybe_trusted_args(mask) {
    let maybe_trusted_args = args.map((value, arg_nr) => {
      return (mask & (2**arg_nr)) ? policy.createScript(value) : value;
    });
    return new Function(...maybe_trusted_args);
  }

  // Generate all combinations of String/TrustedScript, except for the one
  // where all argumentes are TrustedScript.
  for (let mask = 0; mask < arg_max; mask++) {
    test(t => {
      assert_throws_js(EvalError,
                       _ => new_function_with_maybe_trusted_args(mask));
    }, "Function constructor with mixed plain and trusted strings, mask #" + mask);
  }

  // Now do one with all trusted arguments.
  test(t => {
    const f = new_function_with_maybe_trusted_args(arg_max);
    assert_equals(f(1,2,3), 9);
    assert_equals(f(1,2), 15);
  }, "Function constructor with mixed plain and trusted strings, mask #" + arg_max);
</script>