Support Trusted Types in EvalSourceMapDevToolPlugin

Feature request

What is the expected behavior?

Say webpack is configured with output.trustedTypes = true and devtool = “eval-cheap-module-source-map”. I expect that generated code can still use eval but the script will be created using createScript method from Trusted Types policy.

What is motivation or use case for adding/changing the behavior?

This is needed when working with Trusted Types during local development. Passing string argument into eval() is forbidden when you enforce require-trusted-types-for 'script' CSP directive. This is exactly what EvalSourceMapDevToolPlugin is doing and therefore it is hard to debug such application locally.

How should this be implemented in your opinion?

We could probably follow similar approach as with CreateScriptUrlRuntimeModule and based on whether trusted types are enabled or not return either raw string or output of policy.createScript(). This value can then be passed to eval().

Are you willing to work on this yourself? yes

[tosmolka]

@alexander-akait , @sokra , can we pls get a feedback on https://github.com/webpack/webpack/pull/14173? Happy to change the approach if you have any suggestions. Thank you.

[alexander-akait]

Fixed https://github.com/webpack/webpack/pull/14173