[core-xml] port https://github.com/Azure/ms-rest-js/pull/475

[jeremymeng]

Original PR description:

Zlatkovsky commented on Nov 15, 2022
In our use-case of the ms-rest-js library, we have a large existing application (complete with caching, service-workers, etc) that we dynamically load additional JavaScript code into. The additional JS is what brings in the ms-rest-js.

The application has Trusted Types enabled (e.g., CSP rule 'trusted-types LibraryA LibraryB etc). But, interestingly, its require-trusted-types-for 'script' is currently under "report only" (Content-Security-Policy-Report-Only). In those cases, a call to trustedTypes.createPolicy will fail because the policy isn't on the allowed-list, even though skipping the createPolicy would be OK. So in effect, Azure/ms-rest-js@531aea9 introduced a regression.

We are working on extending the allow-list of our application to include @azure/ms-rest-js#xml.browser, but that change takes time. In the meantime, we'd like to wrap the policy-creation in a try/catch. There is no security risk to it, since for host applications that DO have strict enforcement of trusted-types, the code will simply fail when the dangerous sink is used (e.g., when doing parseFromString). And likewise, wrapping in try/catch and doing nothing on catch is OK, because the code already deals with the possibility of the trustedTypes API not being available on the browser.

Packages impacted by this PR

@azure/core-xml

[azure-sdk]

API change check

API changes are not detected in this pull request.