2016-04-12 16:40:37 +00:00
|
|
|
import {
|
2016-04-29 00:50:03 +00:00
|
|
|
Provider,
|
2016-04-12 16:40:37 +00:00
|
|
|
PLATFORM_INITIALIZER,
|
|
|
|
|
PLATFORM_DIRECTIVES,
|
|
|
|
|
PLATFORM_PIPES,
|
|
|
|
|
ExceptionHandler,
|
|
|
|
|
RootRenderer,
|
|
|
|
|
APPLICATION_COMMON_PROVIDERS,
|
2016-04-29 00:50:03 +00:00
|
|
|
PLATFORM_COMMON_PROVIDERS,
|
|
|
|
|
OpaqueToken,
|
|
|
|
|
Testability
|
|
|
|
|
} from '@angular/core';
|
feat: security implementation in Angular 2.
Summary:
This adds basic security hooks to Angular 2.
* `SecurityContext` is a private API between core, compiler, and
platform-browser. `SecurityContext` communicates what context a value is used
in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
determines the security context for an attribute or property (it turns out
attributes and properties match for the purposes of sanitization).
Based on these hooks:
* `DomSchemaElementRegistry` decides what sanitization applies in a particular
context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
Value*s, i.e. the ability to mark a value as safe and not requiring further
sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
(surprise!).
`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).
BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***
Reviewers: IgorMinar
Differential Revision: https://reviews.angular.io/D103
2016-04-29 23:04:08 +00:00
|
|
|
import {wtfInit, SanitizationService} from '../core_private';
|
2016-04-29 00:50:03 +00:00
|
|
|
import {COMMON_DIRECTIVES, COMMON_PIPES, FORM_PROVIDERS} from '@angular/common';
|
feat: security implementation in Angular 2.
Summary:
This adds basic security hooks to Angular 2.
* `SecurityContext` is a private API between core, compiler, and
platform-browser. `SecurityContext` communicates what context a value is used
in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
determines the security context for an attribute or property (it turns out
attributes and properties match for the purposes of sanitization).
Based on these hooks:
* `DomSchemaElementRegistry` decides what sanitization applies in a particular
context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
Value*s, i.e. the ability to mark a value as safe and not requiring further
sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
(surprise!).
`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).
BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***
Reviewers: IgorMinar
Differential Revision: https://reviews.angular.io/D103
2016-04-29 23:04:08 +00:00
|
|
|
import {
|
|
|
|
|
DomSanitizationService,
|
|
|
|
|
DomSanitizationServiceImpl
|
|
|
|
|
} from './security/dom_sanitization_service';
|
2016-04-29 00:50:03 +00:00
|
|
|
|
|
|
|
|
import {IS_DART} from './facade/lang';
|
2015-11-17 23:24:36 +00:00
|
|
|
import {BrowserDomAdapter} from './browser/browser_adapter';
|
2016-04-29 00:50:03 +00:00
|
|
|
import {BrowserGetTestability} from './browser/testability';
|
|
|
|
|
import {getDOM} from './dom/dom_adapter';
|
|
|
|
|
import {DOCUMENT} from './dom/dom_tokens';
|
|
|
|
|
import {EVENT_MANAGER_PLUGINS, EventManager} from './dom/events/event_manager';
|
|
|
|
|
import {DomRootRenderer, DomRootRenderer_} from './dom/dom_renderer';
|
|
|
|
|
import {SharedStylesHost} from './dom/shared_styles_host';
|
|
|
|
|
import {KeyEventsPlugin} from './dom/events/key_events';
|
|
|
|
|
import {ELEMENT_PROBE_PROVIDERS} from './dom/debug/ng_probe';
|
|
|
|
|
import {DomEventsPlugin} from './dom/events/dom_events';
|
2016-04-12 16:40:37 +00:00
|
|
|
import {
|
|
|
|
|
HAMMER_GESTURE_CONFIG,
|
2016-04-24 17:41:20 +00:00
|
|
|
HammerGestureConfig,
|
|
|
|
|
HammerGesturesPlugin
|
2016-05-02 05:50:37 +00:00
|
|
|
} from './dom/events/hammer_gestures';
|
2016-04-29 00:50:03 +00:00
|
|
|
import {DomSharedStylesHost} from './dom/shared_styles_host';
|
|
|
|
|
import {AnimationBuilder} from './animate/animation_builder';
|
|
|
|
|
import {BrowserDetails} from './animate/browser_details';
|
|
|
|
|
|
|
|
|
|
export {Title} from './browser/title';
|
2015-11-17 23:24:36 +00:00
|
|
|
export {BrowserDomAdapter} from './browser/browser_adapter';
|
2016-04-29 00:50:03 +00:00
|
|
|
export {enableDebugTools, disableDebugTools} from './browser/tools/tools';
|
|
|
|
|
export {By} from './dom/debug/by';
|
2015-11-13 19:21:16 +00:00
|
|
|
|
2016-04-26 04:47:33 +00:00
|
|
|
export const BROWSER_PLATFORM_MARKER =
|
|
|
|
|
/*@ts2dart_const*/ new OpaqueToken('BrowserPlatformMarker');
|
2016-04-14 21:52:35 +00:00
|
|
|
|
2015-12-03 23:49:09 +00:00
|
|
|
/**
|
|
|
|
|
* A set of providers to initialize the Angular platform in a web browser.
|
|
|
|
|
*
|
|
|
|
|
* Used automatically by `bootstrap`, or can be passed to {@link platform}.
|
|
|
|
|
*/
|
2016-04-29 06:28:13 +00:00
|
|
|
export const BROWSER_PROVIDERS: Array<any /*Type | Provider | any[]*/> = /*@ts2dart_const*/[
|
|
|
|
|
/*@ts2dart_Provider*/ {provide: BROWSER_PLATFORM_MARKER, useValue: true},
|
2015-11-18 17:18:37 +00:00
|
|
|
PLATFORM_COMMON_PROVIDERS,
|
2016-04-29 06:28:13 +00:00
|
|
|
/*@ts2dart_Provider*/ {provide: PLATFORM_INITIALIZER, useValue: initDomAdapter, multi: true},
|
2016-04-26 04:58:48 +00:00
|
|
|
];
|
2015-11-13 19:21:16 +00:00
|
|
|
|
|
|
|
|
function _exceptionHandler(): ExceptionHandler {
|
2015-12-08 21:27:56 +00:00
|
|
|
// !IS_DART is required because we must rethrow exceptions in JS,
|
|
|
|
|
// but must not rethrow exceptions in Dart
|
2016-04-29 00:50:03 +00:00
|
|
|
return new ExceptionHandler(getDOM(), !IS_DART);
|
2015-11-13 19:21:16 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function _document(): any {
|
2016-04-29 00:50:03 +00:00
|
|
|
return getDOM().defaultDoc();
|
2015-11-13 19:21:16 +00:00
|
|
|
}
|
|
|
|
|
|
feat: security implementation in Angular 2.
Summary:
This adds basic security hooks to Angular 2.
* `SecurityContext` is a private API between core, compiler, and
platform-browser. `SecurityContext` communicates what context a value is used
in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
determines the security context for an attribute or property (it turns out
attributes and properties match for the purposes of sanitization).
Based on these hooks:
* `DomSchemaElementRegistry` decides what sanitization applies in a particular
context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
Value*s, i.e. the ability to mark a value as safe and not requiring further
sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
(surprise!).
`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).
BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***
Reviewers: IgorMinar
Differential Revision: https://reviews.angular.io/D103
2016-04-29 23:04:08 +00:00
|
|
|
export const BROWSER_SANITIZATION_PROVIDERS: Array<any> = /*@ts2dart_const*/[
|
|
|
|
|
/* @ts2dart_Provider */ {provide: SanitizationService, useExisting: DomSanitizationService},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: DomSanitizationService, useClass: DomSanitizationServiceImpl},
|
|
|
|
|
];
|
|
|
|
|
|
2015-12-03 23:49:09 +00:00
|
|
|
/**
|
|
|
|
|
* A set of providers to initialize an Angular application in a web browser.
|
|
|
|
|
*
|
|
|
|
|
* Used automatically by `bootstrap`, or can be passed to {@link PlatformRef.application}.
|
|
|
|
|
*/
|
2016-04-26 04:47:33 +00:00
|
|
|
export const BROWSER_APP_COMMON_PROVIDERS: Array<any /*Type | Provider | any[]*/> =
|
2016-04-26 05:25:21 +00:00
|
|
|
/*@ts2dart_const*/[
|
2016-04-26 04:47:33 +00:00
|
|
|
APPLICATION_COMMON_PROVIDERS,
|
|
|
|
|
FORM_PROVIDERS,
|
feat: security implementation in Angular 2.
Summary:
This adds basic security hooks to Angular 2.
* `SecurityContext` is a private API between core, compiler, and
platform-browser. `SecurityContext` communicates what context a value is used
in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
determines the security context for an attribute or property (it turns out
attributes and properties match for the purposes of sanitization).
Based on these hooks:
* `DomSchemaElementRegistry` decides what sanitization applies in a particular
context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
Value*s, i.e. the ability to mark a value as safe and not requiring further
sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
(surprise!).
`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).
BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***
Reviewers: IgorMinar
Differential Revision: https://reviews.angular.io/D103
2016-04-29 23:04:08 +00:00
|
|
|
BROWSER_SANITIZATION_PROVIDERS,
|
2016-04-26 05:25:21 +00:00
|
|
|
/* @ts2dart_Provider */ {provide: PLATFORM_PIPES, useValue: COMMON_PIPES, multi: true},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: PLATFORM_DIRECTIVES, useValue: COMMON_DIRECTIVES, multi: true},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: ExceptionHandler, useFactory: _exceptionHandler, deps: []},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: DOCUMENT, useFactory: _document, deps: []},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: EVENT_MANAGER_PLUGINS, useClass: DomEventsPlugin, multi: true},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: EVENT_MANAGER_PLUGINS, useClass: KeyEventsPlugin, multi: true},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: EVENT_MANAGER_PLUGINS, useClass: HammerGesturesPlugin, multi: true},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: HAMMER_GESTURE_CONFIG, useClass: HammerGestureConfig},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: DomRootRenderer, useClass: DomRootRenderer_},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: RootRenderer, useExisting: DomRootRenderer},
|
|
|
|
|
/* @ts2dart_Provider */ {provide: SharedStylesHost, useExisting: DomSharedStylesHost},
|
2016-04-26 04:47:33 +00:00
|
|
|
DomSharedStylesHost,
|
|
|
|
|
Testability,
|
|
|
|
|
BrowserDetails,
|
|
|
|
|
AnimationBuilder,
|
|
|
|
|
EventManager,
|
|
|
|
|
ELEMENT_PROBE_PROVIDERS
|
2016-04-26 04:58:48 +00:00
|
|
|
];
|
2015-11-13 19:21:16 +00:00
|
|
|
|
2016-04-29 00:50:03 +00:00
|
|
|
|
|
|
|
|
export {
|
|
|
|
|
HAMMER_GESTURE_CONFIG,
|
|
|
|
|
HammerGestureConfig
|
|
|
|
|
} from '../src/dom/events/hammer_gestures'
|
|
|
|
|
|
2016-04-06 22:58:23 +00:00
|
|
|
|
2016-05-02 05:50:37 +00:00
|
|
|
export function
|
|
|
|
|
initDomAdapter() {
|
2015-11-13 19:21:16 +00:00
|
|
|
BrowserDomAdapter.makeCurrent();
|
|
|
|
|
wtfInit();
|
|
|
|
|
BrowserGetTestability.init();
|
refactor(WebWorker): Use the new generic bootstrap.
BREAKING CHANGE:
You can no longer bootstrap a WebWorker or Isolate using `bootstrap` or `bootstrapWebWorker`. Instead you have to do the following:
In TypeScript:
```TypeScript
// index.js
import {WORKER_RENDER_PLATFORM, WORKER_RENDER_APPLICATION, WORKER_SCRIPT} from "angular2/platforms/worker_render";
import {platform} from "angular2/platform";
platform([WORKER_RENDER_PLATFORM])
.application([WORKER_RENDER_APPLICATION, new Provider(WORKER_SCRIPT, {useValue: "loader.js"});
```
```JavaScript
// loader.js
importScripts("https://cdnjs.cloudflare.com/ajax/libs/es6-shim/0.33.3/es6-shim.js", "https://jspm.io/system@0.16.js", "angular2/web_worker/worker.js");
System.import("app");
```
```TypeScript
// app.ts
import {Component, View} from "angular2/core";
import {WORKER_APP_PLATFORM, setupWebWorker} from "angular2/platforms/worker_app";
import {platform} from "angular2/platform";
@Component({
selector: "hello-world"
})
@View({
template: "<h1>Hello {{name}}</h1>
})
export class HelloWorld {
name: string = "Jane";
}
platform([WORKER_APP_PLATFORM])
.asyncApplication(setupWebWorker, optionalProviders?)
.then((ref) => ref.bootstrap(RootComponent));
```
In Dart:
```Dart
// index.dart
import "angular2/platform.dart";
import "angular2/platforms/worker_render.dart";
main() {
platform([WORKER_RENDER_PLATFORM])
.asyncApplication(initIsolate("my_worker.dart"));
}
```
```Dart
// background_index.dart
import "angular2/platform.dart";
import "angular2/platforms/worker_app.dart";
import "package:angular2/src/core/reflection/reflection.dart";
import "package:angular2/src/core/reflection/reflection_capabilities.dart";
@Component(
selector: "hello-world"
)
@View(
template: "<h1>Hello {{name}}</h1>"
)
class HelloWorld {
String name = "Jane";
}
main(List<String> args, SendPort replyTo) {
reflector.reflectionCapabilities = new ReflectionCapabilities();
platform([WORKER_APP_PLATFORM])
.asyncApplication(setupIsolate(replyTo))
.then((ref) => ref.bootstrap(RootComponent));
}
```
You should no longer import from the `angular2/web_worker/worker` and `angular2/web_worker/ui` paths. Instead you can now import directly from core, directives, etc..
The WebWorkerApplication class has been removed. If you want to use ServiceMessageBroker or ClientMessageBroker on the render thread, you must inject their factories via DI.
If you need to use the MessageBus on the render thread you must also obtain it through DI.
closes #3277
closes #5473
Closes #5519
2015-12-03 04:25:24 +00:00
|
|
|
}
|