Elgato_dark/angular
1
0
Fork 0
mirror of https://github.com/angular/angular synced 2026-05-24 09:28:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
angular/packages/core/src/sanitization
History
Guillaume Weghsteen b35fa73968 feat(core): change the URL sanitization to only block javascript: URLs (#49659) 
In modern browsers, the 'javascript:' URL scheme is the only scheme that
can execute JavaScript when passed in a navigation URL context (e.g.
`a.href` value). Validate URL shemes to only contain characters allowed
in the URL specification ([a-zA-Z-+.]), and that are not javascript
(case insensitive). This is not a breaking change. The URL sanitization
is loosen.

PR Close #49659
2023-04-04 15:01:13 -07:00
..
bypass.ts docs: extract XSS security doc URL into a constant (#48082) 2022-11-17 13:21:16 -08:00
html_sanitizer.ts docs: extract XSS security doc URL into a constant (#48082) 2022-11-17 13:21:16 -08:00
iframe_attrs_validation.ts fix(core): hardening attribute and property binding rules for <iframe> elements (#47964) 2022-11-09 00:47:56 -08:00
inert_body.ts refactor(core): remove IE11 only sanitization code (#48438) 2023-02-03 09:45:03 -08:00
readme.md refactor(core): move sanitization into core (#22540) 2018-03-07 18:24:06 -08:00
sanitization.ts refactor(core): consolidate LView state from injectors (#49641) 2023-03-30 09:37:47 -07:00
sanitizer.ts feat(core): manually annotate de-sugarred core tree-shakable providers with @pureOrBreakMyCode (#41096) 2021-03-08 10:30:08 -08:00
security.ts build: update license headers to reference Google LLC (#37205) 2020-05-26 14:26:58 -04:00
url_sanitizer.ts feat(core): change the URL sanitization to only block javascript: URLs (#49659) 2023-04-04 15:01:13 -07:00

readme.md

Sanitization

This folder contains sanitization related code.

History

It used to be that sanitization related code used to be in @angular/platform-browser since it is platform related. While this is true, in practice the compiler schema is permanently tied to the DOM and hence the fact that sanitizer could in theory be replaced is not used in practice.

In order to better support tree shaking we need to be able to refer to the sanitization functions from the Ivy code. For this reason the code has been moved into the @angular/core.