normalize output.trustedTypes to an object

declarations/WebpackOptions.d.ts

@@ -753,10 +753,6 @@ export type OptimizationSplitChunksGetCacheGroups = (
 	| OptimizationSplitChunksCacheGroup
 	| OptimizationSplitChunksCacheGroup[]
 	| void;
-/**
- * Use a Trusted Types policy to create urls for chunks.
- */
-export type TrustedTypesPolicy = false | string;
 
 /**
  * Options object as provided by the user.
@@ -2090,9 +2086,9 @@ export interface Output {
 	 */
 	strictModuleExceptionHandling?: StrictModuleExceptionHandling;
 	/**
-	 * Use a Trusted Types policy to create urls for chunks. The default policy name is 'webpack'. Passing a string sets a custom policy name.
+	 * Use a Trusted Types policy to create urls for chunks. 'output.uniqueName' is used a default policy name. Passing a string sets a custom policy name.
 	 */
-	trustedTypesPolicy?: boolean | string;
+	trustedTypes?: true | string | TrustedTypes;
 	/**
 	 * If `output.libraryTarget` is set to umd and `output.library` is set, setting this to true will name the AMD module.
 	 */
@@ -2164,6 +2160,15 @@ export interface Environment {
 	 */
 	module?: boolean;
 }
+/**
+ * Use a Trusted Types policy to create urls for chunks.
+ */
+export interface TrustedTypes {
+	/**
+	 * The name of the Trusted Types policy created by webpack to serve bundle chunks.
+	 */
+	policyName?: string;
+}
 /**
  * Configuration object for web performance recommendations.
  */
@@ -3049,7 +3054,7 @@ export interface OutputNormalized {
 	/**
 	 * Use a Trusted Types policy to create urls for chunks.
 	 */
-	trustedTypesPolicy?: TrustedTypesPolicy;
+	trustedTypes?: TrustedTypes;
 	/**
 	 * A unique name of the webpack build to avoid multiple webpack runtimes to conflict when using globals.
 	 */

lib/RuntimePlugin.js

@@ -321,8 +321,7 @@ class RuntimePlugin {
 			compilation.hooks.runtimeRequirementInTree
 				.for(RuntimeGlobals.loadScript)
 				.tap("RuntimePlugin", (chunk, set) => {
-					const withCreateScriptUrl = !!compilation.outputOptions
-						.trustedTypesPolicy;
+					const withCreateScriptUrl = !!compilation.outputOptions.trustedTypes;
 					if (withCreateScriptUrl) {
 						set.add(RuntimeGlobals.createScriptUrl);
 					}

lib/config/defaults.js

@@ -713,7 +713,6 @@ const applyOutputDefaults = (
 	D(output, "hashFunction", "md4");
 	D(output, "hashDigest", "hex");
 	D(output, "hashDigestLength", 20);
-	D(output, "trustedTypesPolicy", false);
 	D(output, "strictModuleExceptionHandling", false);
 
 	const optimistic = v => v || v === undefined;
@@ -733,6 +732,16 @@ const applyOutputDefaults = (
 	F(output.environment, "dynamicImport", () => tp && tp.dynamicImport);
 	F(output.environment, "module", () => tp && tp.module);
 
+	const { trustedTypes } = output;
+	if (trustedTypes) {
+		F(
+			trustedTypes,
+			"policyName",
+			() =>
+				output.uniqueName.replace(/[^a-zA-Z0-9\-#=_/@.%]+/g, "_") || "webpack"
+		);
+	}
+
 	/**
 	 * @param {function(EntryDescription): void} fn iterator
 	 * @returns {void}

lib/config/normalization.js

@@ -338,10 +338,15 @@ const getNormalizedWebpackOptions = config => {
 				sourceMapFilename: output.sourceMapFilename,
 				sourcePrefix: output.sourcePrefix,
 				strictModuleExceptionHandling: output.strictModuleExceptionHandling,
-				trustedTypesPolicy:
-					output.trustedTypesPolicy === true
-						? "webpack"
-						: output.trustedTypesPolicy,
+				trustedTypes: optionalNestedConfig(
+					output.trustedTypes,
+					trustedTypes => {
+						if (trustedTypes === true) return {};
+						if (typeof trustedTypes === "string")
+							return { policyName: trustedTypes };
+						return { ...trustedTypes };
+					}
+				),
 				uniqueName: output.uniqueName,
 				wasmLoading: output.wasmLoading,
 				webassemblyModuleFilename: output.webassemblyModuleFilename,

lib/dependencies/WorkerPlugin.js

@@ -303,7 +303,7 @@ class WorkerPlugin {
 						block.addDependency(dep);
 						parser.state.module.addBlock(block);
 
-						if (compilation.outputOptions.trustedTypesPolicy) {
+						if (compilation.outputOptions.trustedTypes) {
 							const dep = new CreateScriptUrlDependency(
 								expr.arguments[0].range
 							);

lib/runtime/CreateScriptUrlRuntimeModule.js

@@ -19,10 +19,10 @@ class CreateScriptUrlRuntimeModule extends HelperRuntimeModule {
 	generate() {
 		const { compilation } = this;
 		const { runtimeTemplate, outputOptions } = compilation;
-		const { trustedTypesPolicy } = outputOptions;
+		const { trustedTypes } = outputOptions;
 		const fn = RuntimeGlobals.createScriptUrl;
 
-		if (!trustedTypesPolicy) {
+		if (!trustedTypes) {
 			// Skip Trusted Types logic.
 			return Template.asString([
 				`${fn} = ${runtimeTemplate.returningFunction("url", "url")};`
@@ -46,7 +46,7 @@ class CreateScriptUrlRuntimeModule extends HelperRuntimeModule {
 					'if (typeof trustedTypes !== "undefined" && trustedTypes.createPolicy) {',
 					Template.indent([
 						`policy = trustedTypes.createPolicy(${JSON.stringify(
-							trustedTypesPolicy
+							trustedTypes.policyName
 						)}, policy);`
 					]),
 					"}"

lib/webworker/ImportScriptsChunkLoadingPlugin.js

@@ -40,8 +40,7 @@ class ImportScriptsChunkLoadingPlugin {
 					if (onceForChunkSet.has(chunk)) return;
 					onceForChunkSet.add(chunk);
 					if (!isEnabledForChunk(chunk)) return;
-					const withCreateScriptUrl = !!compilation.outputOptions
-						.trustedTypesPolicy;
+					const withCreateScriptUrl = !!compilation.outputOptions.trustedTypes;
 					set.add(RuntimeGlobals.moduleFactoriesAddOnly);
 					set.add(RuntimeGlobals.hasOwnProperty);
 					if (withCreateScriptUrl) set.add(RuntimeGlobals.createScriptUrl);

schemas/WebpackOptions.json

@@ -2686,16 +2686,19 @@
         "strictModuleExceptionHandling": {
           "$ref": "#/definitions/StrictModuleExceptionHandling"
         },
-        "trustedTypesPolicy": {
-          "description": "Use a Trusted Types policy to create urls for chunks. The default policy name is 'webpack'. Passing a string sets a custom policy name.",
+        "trustedTypes": {
+          "description": "Use a Trusted Types policy to create urls for chunks. 'output.uniqueName' is used a default policy name. Passing a string sets a custom policy name.",
           "anyOf": [
             {
-              "type": "boolean"
+              "enum": [true]
             },
             {
               "description": "The name of the Trusted Types policy created by webpack to serve bundle chunks.",
               "type": "string",
               "minLength": 1
+            },
+            {
+              "$ref": "#/definitions/TrustedTypes"
             }
           ]
         },
@@ -2852,8 +2855,8 @@
         "strictModuleExceptionHandling": {
           "$ref": "#/definitions/StrictModuleExceptionHandling"
         },
-        "trustedTypesPolicy": {
-          "$ref": "#/definitions/TrustedTypesPolicy"
+        "trustedTypes": {
+          "$ref": "#/definitions/TrustedTypes"
         },
         "uniqueName": {
           "$ref": "#/definitions/UniqueName"
@@ -4372,18 +4375,17 @@
         }
       ]
     },
-    "TrustedTypesPolicy": {
+    "TrustedTypes": {
       "description": "Use a Trusted Types policy to create urls for chunks.",
-      "anyOf": [
-        {
-          "enum": [false]
-        },
-        {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "policyName": {
           "description": "The name of the Trusted Types policy created by webpack to serve bundle chunks.",
           "type": "string",
           "minLength": 1
         }
-      ]
+      }
     },
     "UmdNamedDefine": {
       "description": "If `output.libraryTarget` is set to umd and `output.library` is set, setting this to true will name the AMD module.",

test/Defaults.unittest.js

@@ -326,7 +326,7 @@ describe("Defaults", () => {
 		    "sourceMapFilename": "[file].map[query]",
 		    "sourcePrefix": undefined,
 		    "strictModuleExceptionHandling": false,
-		    "trustedTypesPolicy": false,
+		    "trustedTypes": undefined,
 		    "uniqueName": "webpack",
 		    "wasmLoading": "fetch",
 		    "webassemblyModuleFilename": "[hash].module.wasm",
@@ -1637,7 +1637,8 @@ describe("Defaults", () => {
 		"uniqueName",
 		{
 			output: {
-				uniqueName: "@@@Hello World!"
+				uniqueName: "@@@Hello World!",
+				trustedTypes: true
 			}
 		},
 		e =>
@@ -1655,7 +1656,11 @@ describe("Defaults", () => {
 			-     "hotUpdateGlobal": "webpackHotUpdatewebpack",
 			+     "hotUpdateGlobal": "webpackHotUpdate_Hello_World_",
 			@@ ... @@
+			-     "trustedTypes": undefined,
 			-     "uniqueName": "webpack",
+			+     "trustedTypes": Object {
+			+       "policyName": "@@@Hello_World_",
+			+     },
 			+     "uniqueName": "@@@Hello World!",
 		`)
 	);

test/Validation.test.js

@@ -496,7 +496,7 @@ describe("Validation", () => {
 			expect(msg).toMatchInlineSnapshot(`
 			"Invalid configuration object. Webpack has been initialized using a configuration object that does not match the API schema.
 			 - configuration.output has an unknown property 'ecmaVersion'. These properties are valid:
-			   object { assetModuleFilename?, auxiliaryComment?, charset?, chunkFilename?, chunkFormat?, chunkLoadTimeout?, chunkLoading?, chunkLoadingGlobal?, clean?, compareBeforeEmit?, crossOriginLoading?, devtoolFallbackModuleFilenameTemplate?, devtoolModuleFilenameTemplate?, devtoolNamespace?, enabledChunkLoadingTypes?, enabledLibraryTypes?, enabledWasmLoadingTypes?, environment?, filename?, globalObject?, hashDigest?, hashDigestLength?, hashFunction?, hashSalt?, hotUpdateChunkFilename?, hotUpdateGlobal?, hotUpdateMainFilename?, iife?, importFunctionName?, importMetaName?, library?, libraryExport?, libraryTarget?, module?, path?, pathinfo?, publicPath?, scriptType?, sourceMapFilename?, sourcePrefix?, strictModuleErrorHandling?, strictModuleExceptionHandling?, trustedTypesPolicy?, umdNamedDefine?, uniqueName?, wasmLoading?, webassemblyModuleFilename?, workerChunkLoading?, workerWasmLoading? }
+			   object { assetModuleFilename?, auxiliaryComment?, charset?, chunkFilename?, chunkFormat?, chunkLoadTimeout?, chunkLoading?, chunkLoadingGlobal?, clean?, compareBeforeEmit?, crossOriginLoading?, devtoolFallbackModuleFilenameTemplate?, devtoolModuleFilenameTemplate?, devtoolNamespace?, enabledChunkLoadingTypes?, enabledLibraryTypes?, enabledWasmLoadingTypes?, environment?, filename?, globalObject?, hashDigest?, hashDigestLength?, hashFunction?, hashSalt?, hotUpdateChunkFilename?, hotUpdateGlobal?, hotUpdateMainFilename?, iife?, importFunctionName?, importMetaName?, library?, libraryExport?, libraryTarget?, module?, path?, pathinfo?, publicPath?, scriptType?, sourceMapFilename?, sourcePrefix?, strictModuleErrorHandling?, strictModuleExceptionHandling?, trustedTypes?, umdNamedDefine?, uniqueName?, wasmLoading?, webassemblyModuleFilename?, workerChunkLoading?, workerWasmLoading? }
 			   -> Options affecting the output of the compilation. \`output\` options tell webpack how to write the compiled files to disk.
 			   Did you mean output.environment (output.ecmaVersion was a temporary configuration option during webpack 5 beta)?"
 		`)

test/__snapshots__/Cli.test.js.snap

@@ -5205,22 +5205,38 @@ Object {
     "multiple": false,
     "simpleType": "boolean",
   },
-  "output-trusted-types-policy": Object {
+  "output-trusted-types": Object {
     "configs": Array [
       Object {
-        "description": "Use a Trusted Types policy to create urls for chunks. The default policy name is 'webpack'. Passing a string sets a custom policy name.",
+        "description": "Use a Trusted Types policy to create urls for chunks. 'output.uniqueName' is used a default policy name. Passing a string sets a custom policy name.",
         "multiple": false,
-        "path": "output.trustedTypesPolicy",
-        "type": "boolean",
+        "path": "output.trustedTypes",
+        "type": "enum",
+        "values": Array [
+          true,
+        ],
       },
       Object {
         "description": "The name of the Trusted Types policy created by webpack to serve bundle chunks.",
         "multiple": false,
-        "path": "output.trustedTypesPolicy",
+        "path": "output.trustedTypes",
         "type": "string",
       },
     ],
-    "description": "Use a Trusted Types policy to create urls for chunks. The default policy name is 'webpack'. Passing a string sets a custom policy name. The name of the Trusted Types policy created by webpack to serve bundle chunks.",
+    "description": "Use a Trusted Types policy to create urls for chunks. 'output.uniqueName' is used a default policy name. Passing a string sets a custom policy name. The name of the Trusted Types policy created by webpack to serve bundle chunks.",
+    "multiple": false,
+    "simpleType": "string",
+  },
+  "output-trusted-types-policy-name": Object {
+    "configs": Array [
+      Object {
+        "description": "The name of the Trusted Types policy created by webpack to serve bundle chunks.",
+        "multiple": false,
+        "path": "output.trustedTypes.policyName",
+        "type": "string",
+      },
+    ],
+    "description": "The name of the Trusted Types policy created by webpack to serve bundle chunks.",
     "multiple": false,
     "simpleType": "string",
   },

test/configCases/trusted-types/custom-policy-name/webpack.config.js

@@ -3,7 +3,7 @@ module.exports = {
 	output: {
 		chunkFilename: "[name].web.js",
 		crossOriginLoading: "anonymous",
-		trustedTypesPolicy: "customPolicyName"
+		trustedTypes: "customPolicyName"
 	},
 	performance: {
 		hints: false

test/configCases/trusted-types/default-policy-name/webpack.config.js

@@ -3,7 +3,7 @@ module.exports = {
 	output: {
 		chunkFilename: "[name].web.js",
 		crossOriginLoading: "anonymous",
-		trustedTypesPolicy: true
+		trustedTypes: true
 	},
 	performance: {
 		hints: false

test/configCases/trusted-types/no-trusted-types/webpack.config.js

@@ -3,7 +3,7 @@ module.exports = {
 	output: {
 		chunkFilename: "[name].web.js",
 		crossOriginLoading: "anonymous",
-		trustedTypesPolicy: true
+		trustedTypes: true
 	},
 	performance: {
 		hints: false

test/configCases/trusted-types/web-worker/webpack.config.js

@@ -2,7 +2,7 @@ module.exports = {
 	output: {
 		filename: "[name].js",
 		chunkFilename: "chunk.[name].js",
-		trustedTypesPolicy: true
+		trustedTypes: true
 	},
 	target: "web"
 };

types.d.ts

@@ -7676,9 +7676,9 @@ declare interface Output {
 	strictModuleExceptionHandling?: boolean;
 
 	/**
-	 * Use a Trusted Types policy to create urls for chunks. The default policy name is 'webpack'. Passing a string sets a custom policy name.
+	 * Use a Trusted Types policy to create urls for chunks. 'output.uniqueName' is used a default policy name. Passing a string sets a custom policy name.
 	 */
-	trustedTypesPolicy?: string | boolean;
+	trustedTypes?: string | true | TrustedTypes;
 
 	/**
 	 * If `output.libraryTarget` is set to umd and `output.library` is set, setting this to true will name the AMD module.
@@ -7945,7 +7945,7 @@ declare interface OutputNormalized {
 	/**
 	 * Use a Trusted Types policy to create urls for chunks.
 	 */
-	trustedTypesPolicy?: string | false;
+	trustedTypes?: TrustedTypes;
 
 	/**
 	 * A unique name of the webpack build to avoid multiple webpack runtimes to conflict when using globals.
@@ -10995,6 +10995,16 @@ declare interface TimestampAndHash {
 	timestampHash?: string;
 	hash: string;
 }
+
+/**
+ * Use a Trusted Types policy to create urls for chunks.
+ */
+declare interface TrustedTypes {
+	/**
+	 * The name of the Trusted Types policy created by webpack to serve bundle chunks.
+	 */
+	policyName?: string;
+}
 declare const UNDEFINED_MARKER: unique symbol;
 declare interface UpdateHashContextDependency {
 	chunkGraph: ChunkGraph;