…129818)

flutter/engine@d333434...099a70e

2023-06-30 [email protected] [web] Add nonce configuration. (flutter/engine#42829)
2023-06-30 [email protected] [Impeller] Unwrap optional procs in EntityPass (flutter/engine#43352)
2023-06-30 [email protected] [Impeller] Assign missing user to TODO. (flutter/engine#43351)
2023-06-29 [email protected] Roll Skia from a1ae27969207 to 2d05e3ec6b67 (1 revision) (flutter/engine#43350)
2023-06-29 [email protected] Roll Dart SDK from ecc2440be198 to 2d98d9e27dae (1 revision) (flutter/engine#43347)
2023-06-29 [email protected] [Impeller] Check for lazy memory support. (flutter/engine#43339)
2023-06-29 [email protected] [Impeller] Remove all double empties (flutter/engine#43345)

If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/flutter-engine-flutter-autoroll
Please CC [email protected],[email protected],[email protected] on the revert to ensure that a human
is aware of the problem.

To file a bug in Flutter: https://github.com/flutter/flutter/issues/new/choose

To report a problem with the AutoRoller itself, please file a bug:
https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md

This PR adds a `nonce` JS configuration attribute so users can pass a nonce value to their flutter engine initialization code.

This `nonce` is used to mark all scripts/styles needed by Flutter web that are considered `unsafe-inline` by CSP. In this change, there are only two tags that benefit from this:

* canvaskit.js
* inline styles for text editing

Before this change, the most strict CSP that allows a Flutter Web app to run would look like:

```
script-src 'self' 'nonce-flutter-init-scripts' 'wasm-unsafe-eval' https://www.gstatic.com/flutter-canvaskit/;
font-src https://fonts.gstatic.com;
style-src 'unsafe-inline';
```

After this change, CSP could be tightened to:

```
script-src 'self' 'nonce-YOUR_NONCE_VALUE' 'wasm-unsafe-eval';
font-src https://fonts.gstatic.com;
style-src 'nonce-YOUR_NONCE_VALUE';
```

By initializing the Flutter web app with something like this:

```html
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'nonce-YOUR_NONCE_VALUE' 'wasm-unsafe-eval'; font-src https://fonts.gstatic.com; style-src 'nonce-YOUR_NONCE_VALUE';">

...

<script nonce="YOUR_NONCE_VALUE">
  _flutter.loader.loadEntrypoint({
    onEntrypointLoaded: async function(engineInitializer) {
      let appRunner = await engineInitializer.initializeEngine({
        nonce: 'YOUR_NONCE_VALUE',
      });
      appRunner.runApp();
    }
  });
</script>
```

## Issues

Fixes flutter/flutter#126977 (does not address `flutter.js`, that's a [different story](flutter/flutter#128061))
Helps with flutter/flutter#80221

---

[C++, Objective-C, Java style guides]: https://github.com/flutter/engine/blob/main/CONTRIBUTING.md#style