Elgato_dark/angular
1
0
Fork 0
mirror of https://github.com/angular/angular synced 2026-05-24 09:28:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
angular/packages/core/src/sanitization
History
Andrew Kushnir eaff724b77 fix(core): prevent infinite loops in clobbered elements check (#54425) 
This commit updates HTML sanitization logic to avoid infinite loops in case clobbered elements contain fields like `nextSibling` or `parentNode`. Those fields are used for DOM traversal and this update makes sure that those calls return valid results.

Also this commit fixes an issue when clobbering `nodeName` causes JS exceptions.

PR Close #54425
2024-03-11 12:46:16 -07:00
..
bypass.ts docs: extract XSS security doc URL into a constant (#48082) 2022-11-17 13:21:16 -08:00
html_sanitizer.ts fix(core): prevent infinite loops in clobbered elements check (#54425) 2024-03-11 12:46:16 -07:00
iframe_attrs_validation.ts fix(core): hardening attribute and property binding rules for <iframe> elements (#47964) 2022-11-09 00:47:56 -08:00
inert_body.ts refactor(core): remove IE11 only sanitization code (#48438) 2023-02-03 09:45:03 -08:00
readme.md refactor(core): move sanitization into core (#22540) 2018-03-07 18:24:06 -08:00
sanitization.ts refactor(core): consolidate LView state from injectors (#49641) 2023-03-30 09:37:47 -07:00
sanitizer.ts feat(core): manually annotate de-sugarred core tree-shakable providers with @pureOrBreakMyCode (#41096) 2021-03-08 10:30:08 -08:00
security.ts build: update license headers to reference Google LLC (#37205) 2020-05-26 14:26:58 -04:00
url_sanitizer.ts feat(core): change the URL sanitization to only block javascript: URLs (#49659) 2023-04-04 15:01:13 -07:00

readme.md

Sanitization

This folder contains sanitization related code.

History

It used to be that sanitization related code used to be in @angular/platform-browser since it is platform related. While this is true, in practice the compiler schema is permanently tied to the DOM and hence the fact that sanitizer could in theory be replaced is not used in practice.

In order to better support tree shaking we need to be able to refer to the sanitization functions from the Ivy code. For this reason the code has been moved into the @angular/core.