mirror of
https://github.com/angular/angular
synced 2026-05-24 09:28:37 +00:00
908a102a87
Summary: This adds basic security hooks to Angular 2. * `SecurityContext` is a private API between core, compiler, and platform-browser. `SecurityContext` communicates what context a value is used in across template parser, compiler, and sanitization at runtime. * `SanitizationService` is the bare bones interface to sanitize values for a particular context. * `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)` determines the security context for an attribute or property (it turns out attributes and properties match for the purposes of sanitization). Based on these hooks: * `DomSchemaElementRegistry` decides what sanitization applies in a particular context. * `DomSanitizationService` implements `SanitizationService` and adds *Safe Value*s, i.e. the ability to mark a value as safe and not requiring further sanitization. * `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively (surprise!). `DomSanitizationService` is the default implementation bound for browser applications, in the three contexts (browser rendering, web worker rendering, server side rendering). BREAKING CHANGES: *** SECURITY WARNING *** Angular 2 Release Candidates do not implement proper contextual escaping yet. Make sure to correctly escape all values that go into the DOM. *** SECURITY WARNING *** Reviewers: IgorMinar Differential Revision: https://reviews.angular.io/D103 |
||
|---|---|---|
| .. | ||
| css | ||
| expression_parser | ||
| i18n | ||
| output | ||
| schema | ||
| compile_metadata_spec.ts | ||
| directive_lifecycle_spec.dart | ||
| directive_lifecycle_spec.ts | ||
| directive_normalizer_spec.ts | ||
| directive_resolver_spec.ts | ||
| html_ast_spec_utils.ts | ||
| html_lexer_spec.ts | ||
| html_parser_spec.ts | ||
| legacy_template_spec.ts | ||
| metadata_resolver_fixture.dart | ||
| metadata_resolver_fixture.ts | ||
| metadata_resolver_spec.ts | ||
| offline_compiler_codegen_typed.ts | ||
| offline_compiler_codegen_untyped.ts | ||
| offline_compiler_compa.css.shim.ts | ||
| offline_compiler_spec.ts | ||
| offline_compiler_util.ts | ||
| selector_spec.ts | ||
| shadow_css_spec.ts | ||
| spies.dart | ||
| spies.ts | ||
| style_url_resolver_spec.ts | ||
| template_parser_spec.ts | ||
| template_preparser_spec.ts | ||
| test_bindings.ts | ||
| test_component_builder_spec.ts | ||
| url_resolver_spec.ts | ||
| view_resolver_mock_spec.ts | ||
| view_resolver_spec.ts | ||
| xhr_mock_spec.ts | ||