ASPNet: template compiler csp feature detection

[vorobey]

No description provided.

[Copilot]

Pull request overview

Adds CSP feature detection to the ASP.NET template compiler so it can switch away from new Function-based compilation in CSP-restricted environments and attempt a <script>/globalEval-based fallback.

Changes:

• Introduces CSP detection helpers (readCspDirective, detectCspRestricted) with memoized isCspRestricted().
• Adds compileViaScript() and updates template compilation flow to prefer it when CSP is detected.
• Refactors aspnet.js formatting/structure (UMD wrapper, indentation, trailing commas).

Comments suppressed due to low confidence (3)

packages/devextreme/js/aspnet.js:97

• compileViaScript warns when !src.nonce, but the nonce may be present only as an attribute (via getAttribute('nonce')) depending on the environment. This can produce false warnings and mis-detect whether the compiled script will be allowed by CSP.

            if(isCspRestricted() && !src.nonce) {

packages/devextreme/js/aspnet.js:107

• src.id.replaceAll will throw in environments where String.prototype.replaceAll is not available, and stripping only - does not guarantee a valid function identifier for function <name>() {}. This can break template compilation under CSP.

            var funcName = src.id.replaceAll('-', '');
            var func =
                'function ' + funcName + '(obj,encodeHtml){\n' + code + '\n}';

packages/devextreme/js/aspnet.js:178

• When isCspRestricted() is true and compileViaScript returns null (e.g., templates not backed by a <script> tag), the compiler currently returns the raw template text and skips the new Function path. This can break rendering if CSP detection is a false positive (e.g., nonce is present but unsafe-eval is allowed).

                if(isCspRestricted()) {
                    var compiled = compileViaScript(src, code);
                    return null !== compiled ? compiled : text;
                }