From 4aff4b99239eb428ff597b0111014f6fbb68f6fd Mon Sep 17 00:00:00 2001
From: Johannes Rieken <johannes.rieken@gmail.com>
Date: Thu, 7 Jan 2021 11:13:53 +0100
Subject: [PATCH] trusted types - loader should use trusted script url when
 using script tags, https://github.com/microsoft/vscode/issues/103699

---
 src/bootstrap-window.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/bootstrap-window.js b/src/bootstrap-window.js
index 68e45486be0..cf3d3bfbac5 100644
--- a/src/bootstrap-window.js
+++ b/src/bootstrap-window.js
@@ -99,6 +99,18 @@
 			preferScriptTags: useCustomProtocol
 		};
 
+		// use a trusted types policy when loading via script tags
+		if (loaderConfig.preferScriptTags) {
+			loaderConfig.trustedTypesPolicy = window.trustedTypes?.createPolicy('amdLoader', {
+				createScriptURL(value) {
+					if (value.startsWith(window.location.origin)) {
+						return value;
+					}
+					throw new Error(`Invalid script url: ${value}`);
+				}
+			});
+		}
+
 		// Enable loading of node modules:
 		// - sandbox: we list paths of webpacked modules to help the loader
 		// - non-sandbox: we signal that any module that does not begin with