[Trusted Types] Don't stringify DOM attributes (#19588 redo)

[onionymous]

[Trusted Types] Don't stringify DOM attributes (#19588 redo)

Summary: This is a resubmit of #19588 since it was never merged and closed in error. However, the issue it fixes is still relevant and will unblock rollout of the TT feature flag internally. Copying the original PR message here:

---

Instead of using Trusted Types feature flag, assume that the browser would stringify the attributes, so that React-DOM doesn't have to (making interpolation into node attributes "just work" regardless of the Trusted Types enforcement and availability) . Currently only IE<=9 does not stringify attributes. This PR implicitly drops the support for IE 9.

For attributes undergoing sanitizeURL, the value is stringified in sanitizeURL function, unless enableTrustedTypesIntegration is true and the value is an immutable TrustedScriptURL value. This ascertains that objects with custom toString() function cannot be used to bypass the sanitization (now that DOMPropertyOperations don't stringify on their own).

Fixes facebook/react#19587.

Summary

The PR decouples the attribute stringification from the Trusted Types logic, dropping the former completely. It was only used as a workaround for a IE <=9 browser bug. A small improvement for Trusted Types would be that it moves the most important functionality from behind the flag - i.e. allows most React apps to pass trusted types into DOM sinks without enabling the feature flag.

Some rare functionality and dev warnings are still gated on the flag, but those are unrelated to the stringification issue.

Test Plan

Appropriate tests are added.

[react-sizebot]

Comparing: c5b9375767e2c4102d7e5559d383523736f1c902...468cea793fa41be2928adff6c317d8e52f6f5cde

Critical size changes

Includes critical production bundles, as well as any change greater than 2%:

Name	+/-	Base	Current	+/- gzip	Base gzip	Current gzip
oss-stable/react-dom/cjs/react-dom.production.min.js	=	175.90 kB	175.88 kB	=	54.76 kB	54.75 kB
oss-experimental/react-dom/cjs/react-dom.production.min.js	=	177.97 kB	177.95 kB	=	55.39 kB	55.39 kB
facebook-www/ReactDOM-prod.classic.js	=	570.21 kB	569.72 kB	=	100.35 kB	100.25 kB
facebook-www/ReactDOM-prod.modern.js	=	554.06 kB	553.57 kB	=	97.43 kB	97.35 kB
test_utils/ReactAllWarnings.js	Deleted	67.55 kB	0.00 kB	Deleted	16.54 kB	0.00 kB

Significant size changes

Includes any change greater than 0.2%:

Expand to show

Name	+/-	Base	Current	+/- gzip	Base gzip	Current gzip
test_utils/ReactAllWarnings.js	Deleted	67.55 kB	0.00 kB	Deleted	16.54 kB	0.00 kB

Generated by :no_entry_sign: dangerJS against 468cea793fa41be2928adff6c317d8e52f6f5cde

[github-actions[bot]]

This pull request has been automatically marked as stale. If this pull request is still relevant, please leave any comment (for example, "bump"), and we'll keep it open. We are sorry that we haven't been able to prioritize reviewing it yet. Your contribution is very much appreciated.

[github-actions[bot]]

Closing this pull request after a prolonged period of inactivity. If this issue is still present in the latest release, please ask for this pull request to be reopened. Thank you!