2016-01-06 17:13:44 -05:00
|
|
|
import {
|
2016-04-28 20:50:03 -04:00
|
|
|
SimpleChange,
|
|
|
|
ChangeDetectorRef,
|
|
|
|
ChangeDetectionStrategy,
|
|
|
|
ElementRef,
|
|
|
|
ViewContainerRef,
|
|
|
|
Renderer,
|
|
|
|
RenderComponentType,
|
|
|
|
Injector,
|
|
|
|
QueryList,
|
|
|
|
ViewEncapsulation,
|
|
|
|
TemplateRef
|
|
|
|
} from '@angular/core';
|
feat: security implementation in Angular 2.
Summary:
This adds basic security hooks to Angular 2.
* `SecurityContext` is a private API between core, compiler, and
platform-browser. `SecurityContext` communicates what context a value is used
in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
determines the security context for an attribute or property (it turns out
attributes and properties match for the purposes of sanitization).
Based on these hooks:
* `DomSchemaElementRegistry` decides what sanitization applies in a particular
context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
Value*s, i.e. the ability to mark a value as safe and not requiring further
sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
(surprise!).
`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).
BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***
Reviewers: IgorMinar
Differential Revision: https://reviews.angular.io/D103
2016-04-29 19:04:08 -04:00
|
|
|
import {SecurityContext} from '../core_private';
|
2016-04-28 20:50:03 -04:00
|
|
|
import {
|
|
|
|
AppElement,
|
|
|
|
AppView,
|
|
|
|
DebugAppView,
|
|
|
|
ChangeDetectorState,
|
|
|
|
checkBinding,
|
|
|
|
DebugContext,
|
|
|
|
devModeEqual,
|
2016-01-06 17:13:44 -05:00
|
|
|
flattenNestedViewRenderNodes,
|
|
|
|
interpolate,
|
2016-04-28 20:50:03 -04:00
|
|
|
RenderDebugInfo,
|
|
|
|
StaticNodeDebugInfo,
|
|
|
|
TemplateRef_,
|
|
|
|
uninitialized,
|
|
|
|
ValueUnwrapper,
|
|
|
|
ViewType,
|
|
|
|
ViewUtils,
|
2016-04-22 18:33:32 -04:00
|
|
|
castByValue,
|
2016-04-29 13:43:26 -04:00
|
|
|
EMPTY_ARRAY,
|
|
|
|
EMPTY_MAP,
|
2016-04-22 18:33:32 -04:00
|
|
|
pureProxy1,
|
|
|
|
pureProxy2,
|
|
|
|
pureProxy3,
|
|
|
|
pureProxy4,
|
|
|
|
pureProxy5,
|
|
|
|
pureProxy6,
|
|
|
|
pureProxy7,
|
|
|
|
pureProxy8,
|
|
|
|
pureProxy9,
|
|
|
|
pureProxy10
|
2016-04-28 20:50:03 -04:00
|
|
|
} from '../core_private';
|
|
|
|
|
|
|
|
import {CompileIdentifierMetadata, CompileTokenMetadata} from './compile_metadata';
|
|
|
|
import {assetUrl} from './util';
|
2016-01-06 17:13:44 -05:00
|
|
|
|
2016-04-28 20:50:03 -04:00
|
|
|
var APP_VIEW_MODULE_URL = assetUrl('core', 'linker/view');
|
|
|
|
var VIEW_UTILS_MODULE_URL = assetUrl('core', 'linker/view_utils');
|
|
|
|
var CD_MODULE_URL = assetUrl('core', 'change_detection/change_detection');
|
2016-01-06 17:13:44 -05:00
|
|
|
|
|
|
|
// Reassign the imports to different variables so we can
|
|
|
|
// define static variables with the name of the import.
|
|
|
|
// (only needed for Dart).
|
2016-04-18 16:24:42 -04:00
|
|
|
var impViewUtils = ViewUtils;
|
2016-01-06 17:13:44 -05:00
|
|
|
var impAppView = AppView;
|
2016-04-29 12:11:57 -04:00
|
|
|
var impDebugAppView = DebugAppView;
|
2016-01-06 17:13:44 -05:00
|
|
|
var impDebugContext = DebugContext;
|
|
|
|
var impAppElement = AppElement;
|
|
|
|
var impElementRef = ElementRef;
|
|
|
|
var impViewContainerRef = ViewContainerRef;
|
|
|
|
var impChangeDetectorRef = ChangeDetectorRef;
|
|
|
|
var impRenderComponentType = RenderComponentType;
|
|
|
|
var impQueryList = QueryList;
|
|
|
|
var impTemplateRef = TemplateRef;
|
|
|
|
var impTemplateRef_ = TemplateRef_;
|
|
|
|
var impValueUnwrapper = ValueUnwrapper;
|
|
|
|
var impInjector = Injector;
|
|
|
|
var impViewEncapsulation = ViewEncapsulation;
|
|
|
|
var impViewType = ViewType;
|
|
|
|
var impChangeDetectionStrategy = ChangeDetectionStrategy;
|
|
|
|
var impStaticNodeDebugInfo = StaticNodeDebugInfo;
|
|
|
|
var impRenderer = Renderer;
|
|
|
|
var impSimpleChange = SimpleChange;
|
|
|
|
var impUninitialized = uninitialized;
|
|
|
|
var impChangeDetectorState = ChangeDetectorState;
|
|
|
|
var impFlattenNestedViewRenderNodes = flattenNestedViewRenderNodes;
|
|
|
|
var impDevModeEqual = devModeEqual;
|
|
|
|
var impInterpolate = interpolate;
|
|
|
|
var impCheckBinding = checkBinding;
|
2016-04-22 18:33:32 -04:00
|
|
|
var impCastByValue = castByValue;
|
2016-04-29 13:43:26 -04:00
|
|
|
var impEMPTY_ARRAY = EMPTY_ARRAY;
|
|
|
|
var impEMPTY_MAP = EMPTY_MAP;
|
2016-01-06 17:13:44 -05:00
|
|
|
|
|
|
|
export class Identifiers {
|
2016-05-02 01:50:37 -04:00
|
|
|
static ViewUtils = new CompileIdentifierMetadata(
|
|
|
|
{name: 'ViewUtils', moduleUrl: assetUrl('core', 'linker/view_utils'), runtime: impViewUtils});
|
2016-01-06 17:13:44 -05:00
|
|
|
static AppView = new CompileIdentifierMetadata(
|
|
|
|
{name: 'AppView', moduleUrl: APP_VIEW_MODULE_URL, runtime: impAppView});
|
2016-04-29 12:11:57 -04:00
|
|
|
static DebugAppView = new CompileIdentifierMetadata(
|
|
|
|
{name: 'DebugAppView', moduleUrl: APP_VIEW_MODULE_URL, runtime: impDebugAppView});
|
2016-05-02 01:50:37 -04:00
|
|
|
static AppElement = new CompileIdentifierMetadata(
|
|
|
|
{name: 'AppElement', moduleUrl: assetUrl('core', 'linker/element'), runtime: impAppElement});
|
2016-01-06 17:13:44 -05:00
|
|
|
static ElementRef = new CompileIdentifierMetadata({
|
|
|
|
name: 'ElementRef',
|
2016-04-28 20:50:03 -04:00
|
|
|
moduleUrl: assetUrl('core', 'linker/element_ref'),
|
2016-01-06 17:13:44 -05:00
|
|
|
runtime: impElementRef
|
|
|
|
});
|
|
|
|
static ViewContainerRef = new CompileIdentifierMetadata({
|
|
|
|
name: 'ViewContainerRef',
|
2016-04-28 20:50:03 -04:00
|
|
|
moduleUrl: assetUrl('core', 'linker/view_container_ref'),
|
2016-01-06 17:13:44 -05:00
|
|
|
runtime: impViewContainerRef
|
|
|
|
});
|
|
|
|
static ChangeDetectorRef = new CompileIdentifierMetadata({
|
|
|
|
name: 'ChangeDetectorRef',
|
2016-04-28 20:50:03 -04:00
|
|
|
moduleUrl: assetUrl('core', 'change_detection/change_detector_ref'),
|
2016-01-06 17:13:44 -05:00
|
|
|
runtime: impChangeDetectorRef
|
|
|
|
});
|
|
|
|
static RenderComponentType = new CompileIdentifierMetadata({
|
|
|
|
name: 'RenderComponentType',
|
2016-04-28 20:50:03 -04:00
|
|
|
moduleUrl: assetUrl('core', 'render/api'),
|
2016-01-06 17:13:44 -05:00
|
|
|
runtime: impRenderComponentType
|
|
|
|
});
|
2016-05-02 01:50:37 -04:00
|
|
|
static QueryList = new CompileIdentifierMetadata(
|
|
|
|
{name: 'QueryList', moduleUrl: assetUrl('core', 'linker/query_list'), runtime: impQueryList});
|
2016-01-06 17:13:44 -05:00
|
|
|
static TemplateRef = new CompileIdentifierMetadata({
|
|
|
|
name: 'TemplateRef',
|
2016-04-28 20:50:03 -04:00
|
|
|
moduleUrl: assetUrl('core', 'linker/template_ref'),
|
2016-01-06 17:13:44 -05:00
|
|
|
runtime: impTemplateRef
|
|
|
|
});
|
|
|
|
static TemplateRef_ = new CompileIdentifierMetadata({
|
|
|
|
name: 'TemplateRef_',
|
2016-04-28 20:50:03 -04:00
|
|
|
moduleUrl: assetUrl('core', 'linker/template_ref'),
|
2016-01-06 17:13:44 -05:00
|
|
|
runtime: impTemplateRef_
|
|
|
|
});
|
|
|
|
static ValueUnwrapper = new CompileIdentifierMetadata(
|
|
|
|
{name: 'ValueUnwrapper', moduleUrl: CD_MODULE_URL, runtime: impValueUnwrapper});
|
2016-05-02 01:50:37 -04:00
|
|
|
static Injector = new CompileIdentifierMetadata(
|
|
|
|
{name: 'Injector', moduleUrl: assetUrl('core', 'di/injector'), runtime: impInjector});
|
2016-01-06 17:13:44 -05:00
|
|
|
static ViewEncapsulation = new CompileIdentifierMetadata({
|
|
|
|
name: 'ViewEncapsulation',
|
2016-04-28 20:50:03 -04:00
|
|
|
moduleUrl: assetUrl('core', 'metadata/view'),
|
2016-01-06 17:13:44 -05:00
|
|
|
runtime: impViewEncapsulation
|
|
|
|
});
|
2016-05-02 01:50:37 -04:00
|
|
|
static ViewType = new CompileIdentifierMetadata(
|
|
|
|
{name: 'ViewType', moduleUrl: assetUrl('core', 'linker/view_type'), runtime: impViewType});
|
2016-01-06 17:13:44 -05:00
|
|
|
static ChangeDetectionStrategy = new CompileIdentifierMetadata({
|
|
|
|
name: 'ChangeDetectionStrategy',
|
|
|
|
moduleUrl: CD_MODULE_URL,
|
|
|
|
runtime: impChangeDetectionStrategy
|
|
|
|
});
|
|
|
|
static StaticNodeDebugInfo = new CompileIdentifierMetadata({
|
|
|
|
name: 'StaticNodeDebugInfo',
|
2016-04-28 20:50:03 -04:00
|
|
|
moduleUrl: assetUrl('core', 'linker/debug_context'),
|
2016-01-06 17:13:44 -05:00
|
|
|
runtime: impStaticNodeDebugInfo
|
|
|
|
});
|
|
|
|
static DebugContext = new CompileIdentifierMetadata({
|
|
|
|
name: 'DebugContext',
|
2016-04-28 20:50:03 -04:00
|
|
|
moduleUrl: assetUrl('core', 'linker/debug_context'),
|
2016-01-06 17:13:44 -05:00
|
|
|
runtime: impDebugContext
|
|
|
|
});
|
2016-05-02 01:50:37 -04:00
|
|
|
static Renderer = new CompileIdentifierMetadata(
|
|
|
|
{name: 'Renderer', moduleUrl: assetUrl('core', 'render/api'), runtime: impRenderer});
|
2016-01-06 17:13:44 -05:00
|
|
|
static SimpleChange = new CompileIdentifierMetadata(
|
|
|
|
{name: 'SimpleChange', moduleUrl: CD_MODULE_URL, runtime: impSimpleChange});
|
|
|
|
static uninitialized = new CompileIdentifierMetadata(
|
|
|
|
{name: 'uninitialized', moduleUrl: CD_MODULE_URL, runtime: impUninitialized});
|
|
|
|
static ChangeDetectorState = new CompileIdentifierMetadata(
|
|
|
|
{name: 'ChangeDetectorState', moduleUrl: CD_MODULE_URL, runtime: impChangeDetectorState});
|
|
|
|
static checkBinding = new CompileIdentifierMetadata(
|
|
|
|
{name: 'checkBinding', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: impCheckBinding});
|
|
|
|
static flattenNestedViewRenderNodes = new CompileIdentifierMetadata({
|
|
|
|
name: 'flattenNestedViewRenderNodes',
|
|
|
|
moduleUrl: VIEW_UTILS_MODULE_URL,
|
|
|
|
runtime: impFlattenNestedViewRenderNodes
|
|
|
|
});
|
|
|
|
static devModeEqual = new CompileIdentifierMetadata(
|
|
|
|
{name: 'devModeEqual', moduleUrl: CD_MODULE_URL, runtime: impDevModeEqual});
|
|
|
|
static interpolate = new CompileIdentifierMetadata(
|
|
|
|
{name: 'interpolate', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: impInterpolate});
|
2016-04-22 18:33:32 -04:00
|
|
|
static castByValue = new CompileIdentifierMetadata(
|
|
|
|
{name: 'castByValue', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: impCastByValue});
|
2016-04-29 13:43:26 -04:00
|
|
|
static EMPTY_ARRAY = new CompileIdentifierMetadata(
|
|
|
|
{name: 'EMPTY_ARRAY', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: impEMPTY_ARRAY});
|
|
|
|
static EMPTY_MAP = new CompileIdentifierMetadata(
|
|
|
|
{name: 'EMPTY_MAP', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: impEMPTY_MAP});
|
|
|
|
|
2016-04-22 18:33:32 -04:00
|
|
|
static pureProxies = [
|
|
|
|
null,
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy1', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy1}),
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy2', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy2}),
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy3', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy3}),
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy4', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy4}),
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy5', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy5}),
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy6', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy6}),
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy7', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy7}),
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy8', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy8}),
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy9', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy9}),
|
|
|
|
new CompileIdentifierMetadata(
|
|
|
|
{name: 'pureProxy10', moduleUrl: VIEW_UTILS_MODULE_URL, runtime: pureProxy10}),
|
|
|
|
];
|
feat: security implementation in Angular 2.
Summary:
This adds basic security hooks to Angular 2.
* `SecurityContext` is a private API between core, compiler, and
platform-browser. `SecurityContext` communicates what context a value is used
in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
determines the security context for an attribute or property (it turns out
attributes and properties match for the purposes of sanitization).
Based on these hooks:
* `DomSchemaElementRegistry` decides what sanitization applies in a particular
context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
Value*s, i.e. the ability to mark a value as safe and not requiring further
sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
(surprise!).
`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).
BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***
Reviewers: IgorMinar
Differential Revision: https://reviews.angular.io/D103
2016-04-29 19:04:08 -04:00
|
|
|
static SecurityContext = new CompileIdentifierMetadata({
|
|
|
|
name: 'SecurityContext',
|
|
|
|
moduleUrl: assetUrl('core', 'security'),
|
|
|
|
runtime: SecurityContext,
|
|
|
|
});
|
2016-01-06 17:13:44 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
export function identifierToken(identifier: CompileIdentifierMetadata): CompileTokenMetadata {
|
|
|
|
return new CompileTokenMetadata({identifier: identifier});
|
|
|
|
}
|