[trustedTypes]: Add TrustedTypes support to Svelte

Author: fallaciousreasoning

.changeset/witty-lies-happen.md

@@ -0,0 +1,5 @@
+---
+'svelte': minor
+---
+
+Add TrustedTypes support

packages/svelte/package.json

@@ -166,6 +166,7 @@
     "@jridgewell/sourcemap-codec": "^1.5.0",
     "@sveltejs/acorn-typescript": "^1.0.5",
     "@types/estree": "^1.0.5",
+    "@types/trusted-types": "^2.0.7",
     "acorn": "^8.12.1",
     "aria-query": "^5.3.1",
     "axobject-query": "^4.1.0",

packages/svelte/src/internal/client/dom/reconciler.js

@@ -1,6 +1,25 @@
+/** @import { TrustedTypePolicy } from 'trusted-types' */
+
+/** @type {Pick<TrustedTypePolicy, 'createHTML'> | undefined} */
+let policy;
+
+if (globalThis?.window?.trustedTypes) {
+	policy = globalThis.window.trustedTypes.createPolicy('svelte-trusted-html', {
+		/** @param {string} html */
+		createHTML: (html) => {
+			return html;
+		}
+	});
+}
+
+/** @param {string} html */
+function create_trusted_html(html) {
+	return /** @type {string} */(policy?.createHTML(html) ?? html);
+}
+
 /** @param {string} html */
 export function create_fragment_from_html(html) {
 	var elem = document.createElement('template');
-	elem.innerHTML = html.replaceAll('<!>', '<!---->'); // XHTML compliance
+	elem.innerHTML = create_trusted_html(html.replaceAll('<!>', '<!---->')); // XHTML compliance
 	return elem.content;
 }