fix(youtube-player): fix "ban-script-src-assignments"

Author: jamOne-

package.json

@@ -66,6 +66,7 @@
     "@types/youtube": "^0.1.0",
     "rxjs": "^6.6.7",
     "rxjs-tslint-rules": "^4.34.8",
+    "safevalues": "^1.2.0",
     "tslib": "^2.3.1",
     "zone.js": "~0.15.0"
   },

patches/@angular+bazel+19.1.0-next.0.patch

@@ -0,0 +1,114 @@
+diff --git a/node_modules/@angular/bazel/src/ng_module/ng_module.bzl b/node_modules/@angular/bazel/src/ng_module/ng_module.bzl
+index 5e82bcb..3c239f8 100755
+--- a/node_modules/@angular/bazel/src/ng_module/ng_module.bzl
++++ b/node_modules/@angular/bazel/src/ng_module/ng_module.bzl
+@@ -18,6 +18,7 @@ load(
+     "TsConfigInfo",
+     "compile_ts",
+     "js_ecma_script_module_info",
++    "js_named_module_info",
+     "js_module_info",
+     "node_modules_aspect",
+     "ts_providers_dict_to_struct",
+@@ -151,9 +152,9 @@ def _ngc_tsconfig(ctx, files, srcs, **kwargs):
+     is_devmode = "devmode_manifest" in kwargs
+     outs = _expected_outs(ctx)
+     if is_devmode:
+-        expected_outs = outs.devmode_js
++        expected_outs = outs.devmode_js + outs.declarations
+     else:
+-        expected_outs = outs.closure_js + outs.declarations
++        expected_outs = outs.closure_js
+ 
+     if not ctx.attr.type_check and ctx.attr.strict_templates:
+         fail("Cannot set type_check = False and strict_templates = True for ng_module()")
+@@ -355,11 +356,11 @@ def _compile_action(
+ 
+ def _prodmode_compile_action(ctx, inputs, outputs, tsconfig_file, node_opts):
+     outs = _expected_outs(ctx)
+-    return _compile_action(ctx, inputs, outputs + outs.closure_js + outs.prod_perf_files + outs.declarations, tsconfig_file, node_opts, "prodmode")
++    return _compile_action(ctx, inputs, outputs + outs.closure_js + outs.prod_perf_files, tsconfig_file, node_opts, "prodmode")
+ 
+ def _devmode_compile_action(ctx, inputs, outputs, tsconfig_file, node_opts):
+     outs = _expected_outs(ctx)
+-    compile_action_outputs = outputs + outs.devmode_js + outs.dev_perf_files
++    compile_action_outputs = outputs + outs.devmode_js + outs.dev_perf_files + outs.declarations
+     _compile_action(ctx, inputs, compile_action_outputs, tsconfig_file, node_opts, "devmode")
+ 
+ # Note: We need to define `label` and `srcs_files` as `tsc_wrapped` passes
+@@ -413,9 +414,13 @@ def _ng_module_impl(ctx):
+     # and issue https://github.com/bazelbuild/rules_nodejs/issues/57 for more details.
+     ts_providers["providers"].extend([
+         js_module_info(
+-            sources = ts_providers["typescript"]["es6_sources"],
++            sources = ts_providers["typescript"]["es5_sources"],
+             deps = ctx.attr.deps,
+         ),
++        js_named_module_info(
++           sources = ts_providers["typescript"]["es5_sources"],
++           deps = ctx.attr.deps,
++        ),
+         js_ecma_script_module_info(
+             sources = ts_providers["typescript"]["es6_sources"],
+             deps = ctx.attr.deps,
+@@ -431,7 +436,7 @@ def _ng_module_impl(ctx):
+             package_name = ctx.attr.package_name,
+             package_path = ctx.attr.package_path,
+             path = path,
+-            files = ts_providers["typescript"]["es6_sources"],
++            files = ts_providers["typescript"]["es5_sources"],
+         ))
+ 
+     return ts_providers_dict_to_struct(ts_providers)
+diff --git a/node_modules/@angular/bazel/src/ng_package/packager.mjs b/node_modules/@angular/bazel/src/ng_package/packager.mjs
+index 7184fd9..ef3e508 100755
+--- a/node_modules/@angular/bazel/src/ng_package/packager.mjs
++++ b/node_modules/@angular/bazel/src/ng_package/packager.mjs
+@@ -7,7 +7,7 @@
+  */
+ import * as fs from 'fs';
+ import * as path from 'path';
+-import { analyzeFileAndEnsureNoCrossImports } from './cross_entry_points_imports';
++import { analyzeFileAndEnsureNoCrossImports } from './cross_entry_points_imports.mjs';
+ /**
+  * List of known `package.json` fields which provide information about
+  * supported package formats and their associated entry paths.
+diff --git a/node_modules/@angular/bazel/src/ngc-wrapped/index.mjs b/node_modules/@angular/bazel/src/ngc-wrapped/index.mjs
+index def2972..3de33ba 100755
+--- a/node_modules/@angular/bazel/src/ngc-wrapped/index.mjs
++++ b/node_modules/@angular/bazel/src/ngc-wrapped/index.mjs
+@@ -12,7 +12,7 @@ import tscw from '@bazel/concatjs/internal/tsc_wrapped/index.js';
+ import * as fs from 'fs';
+ import * as path from 'path';
+ import ts from 'typescript';
+-import { EXT, patchNgHostWithFileNameToModuleName as patchNgHost, relativeToRootDirs } from './utils';
++import { EXT, patchNgHostWithFileNameToModuleName as patchNgHost, relativeToRootDirs } from './utils.mjs';
+ // FIXME: we should be able to add the assets to the tsconfig so FileLoader
+ // knows about them
+ const NGC_ASSETS = /\.(css|html)$/;
+@@ -349,6 +349,12 @@ function gatherDiagnosticsForInputsOnly(options, bazelOpts, ngProgram) {
+     }
+     return diagnostics;
+ }
++
++main(process.argv.slice(2)).then(exitCode => process.exitCode = exitCode).catch(e => {
++  console.error(e);
++  process.exitCode = 1;
++});
++
+ /**
+  * @deprecated
+  * Kept here just for compatibility with 1P tools. To be removed soon after 1P update.
+diff --git a/node_modules/@angular/bazel/src/ngc-wrapped/ngc-wrapped-main.mjs b/node_modules/@angular/bazel/src/ngc-wrapped/ngc-wrapped-main.mjs
+index 8efba56..be29334 100755
+--- a/node_modules/@angular/bazel/src/ngc-wrapped/ngc-wrapped-main.mjs
++++ b/node_modules/@angular/bazel/src/ngc-wrapped/ngc-wrapped-main.mjs
+@@ -5,7 +5,7 @@
+  * Use of this source code is governed by an MIT-style license that can be
+  * found in the LICENSE file at https://angular.dev/license
+  */
+-import { main } from './index';
++import { main } from './index.mjs';
+ main(process.argv.slice(2))
+     .then((exitCode) => (process.exitCode = exitCode))
+     .catch((e) => {

src/youtube-player/BUILD.bazel

@@ -28,6 +28,7 @@ ng_module(
         "@npm//@angular/core",
         "@npm//@types/youtube",
         "@npm//rxjs",
+        "@npm//safevalues",
     ],
 )
 

src/youtube-player/package.json

@@ -23,7 +23,8 @@
   "peerDependencies": {
     "@angular/core": "0.0.0-NG",
     "@angular/common": "0.0.0-NG",
-    "rxjs": "0.0.0-RXJS"
+    "rxjs": "0.0.0-RXJS",
+    "safevalues": "^1.2.0"
   },
   "sideEffects": false,
   "schematics": "./schematics/collection.json",

src/youtube-player/youtube-player.ts

@@ -32,6 +32,8 @@ import {
   EventEmitter,
 } from '@angular/core';
 import {isPlatformBrowser} from '@angular/common';
+import {trustedResourceUrl} from 'safevalues';
+import {setScriptSrc} from 'safevalues/dom';
 import {Observable, of as observableOf, Subject, BehaviorSubject, fromEventPattern} from 'rxjs';
 import {takeUntil, switchMap} from 'rxjs/operators';
 import {PlaceholderImageQuality, YouTubePlayerPlaceholder} from './youtube-player-placeholder';
@@ -743,7 +745,7 @@ function loadApi(nonce: string | null): void {
   }
 
   // We can use `document` directly here, because this logic doesn't run outside the browser.
-  const url = 'https://www.youtube.com/iframe_api';
+  const url = trustedResourceUrl`https://www.youtube.com/iframe_api`;
   const script = document.createElement('script');
   const callback = (event: Event) => {
     script.removeEventListener('load', callback);
@@ -759,7 +761,7 @@ function loadApi(nonce: string | null): void {
   };
   script.addEventListener('load', callback);
   script.addEventListener('error', callback);
-  script.src = url;
+  setScriptSrc(script, url);
   script.async = true;
 
   if (nonce) {

yarn.lock

@@ -13685,6 +13685,11 @@ safe-stable-stringify@^2.3.1:
   resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
   integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==
 
+safevalues@^1.2.0:
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/safevalues/-/safevalues-1.2.0.tgz#f9e646d6ebf31788004ef192d2a7d646c9896bb2"
+  integrity sha512-zIsuhjYvJCjfsfjoim2ab6gLKFYAnTiDSJGh0cC3T44L/4kNLL90hBG2BzrXPrHA3f8Ms8FSJ1mljKH5dVR1cw==
+
 [email protected]:
   version "16.0.5"
   resolved "https://registry.yarnpkg.com/sass-loader/-/sass-loader-16.0.5.tgz#257bc90119ade066851cafe7f2c3f3504c7cda98"