Change Intent

dart:js_interop's importModule should accept a JSAny instead of a String.

Original issue here: #55429

Justification

JavaScript's dynamic import function can accept more than just Strings. See https://tc39.es/proposal-dynamic-import/#sec-import-call-runtime-semantics-evaluation and https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import#importing_modules_with_a_non-literal_specifier. One key usage is the ability to pass a TrustedScriptURL, allowing a sanitized specifier to be imported.

Impact

Minimal. There's only one usage in GitHub, and no usages in the SDK, google3, or Flutter.

Mitigation

The fix is to convert the String to a JSString using toJS e.g.

importModule('module') -> importModule('module'.toJS)

I don't believe mitigation is possible due to it being a parameter and not a return type. There's no way to "test" that a function takes in a specific type. One possibility that may work if it only needs to be mitigated for DDC and dart2js is to use dynamic to pass the value to importModule e.g.

importModule('module' as dynamic);

Since JSString is a Dart String when compiling to JS, this will avoid the breakage. This won't work for mitigating the issue for dart2wasm.

Change Timeline

This is a simple change and should go in Dart 3.5. No specific beta is planned yet.

Associated CLs

WIP CL here: https://dart-review.googlesource.com/c/sdk/+/363504