Sandbox: use same trusted types default policy than grafana main realm (#75539)

public/app/core/trustedTypePolicies.ts

@@ -3,27 +3,29 @@ import { config } from '@grafana/runtime';
 
 const CSP_REPORT_ONLY_ENABLED = config.bootData.settings.cspReportOnlyEnabled;
 
+export const defaultTrustedTypesPolicy = {
+  createHTML: (string: string, source: string, sink: string) => {
+    if (!CSP_REPORT_ONLY_ENABLED) {
+      return string.replace(/<script/gi, '&lt;script');
+    }
+    console.error('[HTML not sanitized with Trusted Types]', string, source, sink);
+    return string;
+  },
+  createScript: (string: string) => string,
+  createScriptURL: (string: string, source: string, sink: string) => {
+    if (!CSP_REPORT_ONLY_ENABLED) {
+      return textUtil.sanitizeUrl(string);
+    }
+    console.error('[ScriptURL not sanitized with Trusted Types]', string, source, sink);
+    return string;
+  },
+};
+
 if (
   config.bootData.settings.trustedTypesDefaultPolicyEnabled &&
   window.trustedTypes &&
   window.trustedTypes.createPolicy
 ) {
   // check if browser supports Trusted Types
-  window.trustedTypes.createPolicy('default', {
+  window.trustedTypes.createPolicy('default', defaultTrustedTypesPolicy);
-    createHTML: (string, source, sink) => {
-      if (!CSP_REPORT_ONLY_ENABLED) {
-        return string.replace(/<script/gi, '&lt;script');
-      }
-      console.error('[HTML not sanitized with Trusted Types]', string, source, sink);
-      return string;
-    },
-    createScript: (string) => string,
-    createScriptURL: (string, source, sink) => {
-      if (!CSP_REPORT_ONLY_ENABLED) {
-        return textUtil.sanitizeUrl(string);
-      }
-      console.error('[ScriptURL not sanitized with Trusted Types]', string, source, sink);
-      return string;
-    },
-  });
 }

public/app/features/plugins/sandbox/sandbox_plugin_loader.ts

@@ -2,6 +2,7 @@ import createVirtualEnvironment from '@locker/near-membrane-dom';
 import { ProxyTarget } from '@locker/near-membrane-shared';
 
 import { PluginMeta } from '@grafana/data';
+import { defaultTrustedTypesPolicy } from 'app/core/trustedTypePolicies';
 
 import { getPluginSettings } from '../pluginSettings';
 
@@ -72,11 +73,7 @@ async function doImportPluginModuleInSandbox(meta: PluginMeta): Promise<System.M
       // distortions are interceptors to modify the behavior of objects when
       // the code inside the sandbox tries to access them
       distortionCallback,
-      defaultPolicy: {
+      defaultPolicy: defaultTrustedTypesPolicy,
-        createHTML: (string: string) => string,
-        createScript: (string: string) => string,
-        createScriptURL: (string: string) => string,
-      },
       liveTargetCallback: isLiveTarget,
       // endowments are custom variables we make available to plugins in their window object
       endowments: Object.getOwnPropertyDescriptors({