Support for custom types in Trusted Type policies.

example.js

// Custom types for https://github.com/WICG/trusted-types/ 

// Allow a given TT policy to create custom unspoofable TrustedFoo instances.
const installFoo = (policy, rule, policyFactory) => {
    const creatorSymbol = Symbol();
    const map = new WeakMap();
    // Some more defensive coding tricks can be applied here
    // See https://github.com/WICG/trusted-types/blob/master/src/trustedtypes.js for inspiration.

    class TrustedFoo {
        constructor(s) {
            if (s !== creatorSymbol) {
                throw new Error('cannot create');
            }
        }
        toString() {
            return map.get(this);
        }
    }
    Object.freeze(TrustedFoo.prototype);

    Object.defineProperty(policy, 'createFoo', {
        value: (input) => {
            const transformedInput = '' + rule.apply(null, [input]);
            const foo = new TrustedFoo(creatorSymbol);
            map.set(foo, transformedInput);
            return foo;
        },
        configurable: false
    });

    Object.defineProperty(policyFactory, 'isFoo', {
        value: (obj) => map.has(obj),
        configurable: false
    });
}

// Regular policy
const policy = TrustedTypes.createPolicy('allowedPolicyName', {});

// Custom rules for creating TrustedFoo
const ruleForFoo = (s) => 'Sanitized trustedFoo:' + s;

installFoo(policy, ruleForFoo, TrustedTypes);

// A sink function - you can hijack existing sinks via Object.defineProperty.
function riskyFunction(anyInput) {
    if (TrustedTypes.isFoo(anyInput)) {
        console.log('accepting', anyInput, '' + anyInput);
    } else {
        console.error('rejecting', anyInput);
    }
}
 

const foo = policy.createFoo('bar');

riskyFunction(foo);
riskyFunction('danger');
// spoofing
riskyFunction(Object.create(foo));
try{riskyFunction(new foo.constructor);}catch(e){}
foo.toString = (s) => alert(1);
foo.__proto__.toString = (s) => alert(2);
riskyFunction(foo);

what is the purpose of the creatorSymbol if you are anyway using the weak map to keep track of all the real instances ?

Just an additional safeguard. map is enough for non-spoofability at sinks. Throwing in constructor just makes it obvious at TT object creation time (but can be bypassed e.g. with Object.create).