fix: replace innerHTML with trustedTypes (#808)

Signed-off-by: anuoua <[email protected]>
Co-authored-by: L <[email protected]>

core/parcel-runtime/src/utils/loading-indicator.ts

@@ -10,6 +10,11 @@
 
 const LOADING_ID = "__plasmo-loading__"
 
+const trustedPolicy = typeof trustedTypes !== "undefined"
+  ? trustedTypes
+    .createPolicy(`trusted-html-${LOADING_ID}`, { createHTML: str => str })
+  : undefined
+
 function getLoader() {
   return document.getElementById(LOADING_ID)
 }
@@ -22,7 +27,7 @@ function createLoader() {
   const loadingEl = document.createElement("div")
   loadingEl.id = LOADING_ID
 
-  loadingEl.innerHTML = `
+  const htmlText = `
   <style>
     #${LOADING_ID} {
       background: #f3f3f3;
@@ -72,6 +77,8 @@ function createLoader() {
   <span class="hidden">Context Invalidated, Press to Reload</span>
   `
 
+  loadingEl.innerHTML = trustedPolicy ? trustedPolicy.createHTML(htmlText) : htmlText
+
   loadingEl.style.pointerEvents = "none"
 
   loadingEl.style.position = "fixed"