honeymoose
/
angular-cn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

refactor(compiler): remove unnecessary trustConstantScript function (#39554) 

Script tags, inline event handlers and other script contexts are
forbidden or stripped from Angular templates by the compiler. In the
context of Trusted Types, this leaves no sinks that require use of a
TrustedScript. This means that trustConstantScript is never used, and
can be removed.

PR Close #39554
This commit is contained in:
Bjarki 2020-11-18 17:02:41 +00:00 committed by Andrew Kushnir
parent 4916870dff
commit 2ae3fa009e
5 changed files with 2 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
packages/compiler/src/render3/r3_identifiers.ts
View File

@ -321,8 +321,6 @@ export class Identifiers {
static sanitizeUrlOrResourceUrl:
o.ExternalReference = {name: 'ɵɵsanitizeUrlOrResourceUrl', moduleName: CORE};
static trustConstantHtml: o.ExternalReference = {name: 'ɵɵtrustConstantHtml', moduleName: CORE};
static trustConstantScript:
o.ExternalReference = {name: 'ɵɵtrustConstantScript', moduleName: CORE};
static trustConstantResourceUrl:
o.ExternalReference = {name: 'ɵɵtrustConstantResourceUrl', moduleName: CORE};
}

3
packages/compiler/src/render3/view/template.ts
View File

@ -2156,8 +2156,7 @@ function trustedConstAttribute(tagName: string, attr: t.TextAttribute): o.Expres
switch (elementRegistry.securityContext(tagName, attr.name, /* isAttribute */ true)) {
case core.SecurityContext.HTML:
return o.importExpr(R3.trustConstantHtml).callFn([value], attr.valueSpan);
case core.SecurityContext.SCRIPT:
return o.importExpr(R3.trustConstantScript).callFn([value], attr.valueSpan);
// NB: no SecurityContext.SCRIPT here, as the corresponding tags are stripped by the compiler.
case core.SecurityContext.RESOURCE_URL:
return o.importExpr(R3.trustConstantResourceUrl).callFn([value], attr.valueSpan);
default:

1
packages/core/src/core_render3_private_export.ts
View File

@ -296,7 +296,6 @@ export {
ɵɵsanitizeUrlOrResourceUrl,
ɵɵtrustConstantHtml,
ɵɵtrustConstantResourceUrl,
ɵɵtrustConstantScript,
} from './sanitization/sanitization';
export {
noSideEffects as ɵnoSideEffects,

1
packages/core/src/render3/jit/environment.ts
View File

@ -168,7 +168,6 @@ export const angularCoreEnv: {[name: string]: Function} =
'ɵɵsanitizeUrl': sanitization.ɵɵsanitizeUrl,
'ɵɵsanitizeUrlOrResourceUrl': sanitization.ɵɵsanitizeUrlOrResourceUrl,
'ɵɵtrustConstantHtml': sanitization.ɵɵtrustConstantHtml,
'ɵɵtrustConstantScript': sanitization.ɵɵtrustConstantScript,
'ɵɵtrustConstantResourceUrl': sanitization.ɵɵtrustConstantResourceUrl,
'ɵɵngDeclareDirective': partial.ɵɵngDeclareDirective,

17
packages/core/src/sanitization/sanitization.ts
View File

@ -11,7 +11,7 @@ import {SANITIZER} from '../render3/interfaces/view';
import {getLView} from '../render3/state';
import {renderStringify} from '../render3/util/stringify_utils';
import {TrustedHTML, TrustedScript, TrustedScriptURL} from '../util/security/trusted_type_defs';
import {trustedHTMLFromString, trustedScriptFromString, trustedScriptURLFromString} from '../util/security/trusted_types';
import {trustedHTMLFromString, trustedScriptURLFromString} from '../util/security/trusted_types';
import {trustedHTMLFromStringBypass, trustedScriptFromStringBypass, trustedScriptURLFromStringBypass} from '../util/security/trusted_types_bypass';
import {allowSanitizationBypassAndThrow, BypassType, unwrapSafeValue} from './bypass';
@ -159,21 +159,6 @@ export function ɵɵtrustConstantHtml(html: string): TrustedHTML|string {
return trustedHTMLFromString(html);
}
/**
* Promotes the given constant string to a TrustedScript.
* @param script constant string containing a trusted script.
* @returns TrustedScript wrapping `script`.
*
* @security This is a security-sensitive function and should only be used to
* convert constant values of attributes and properties found in
* application-provided Angular templates to TrustedScript.
*
* @codeGenApi
*/
export function ɵɵtrustConstantScript(script: string): TrustedScript|string {
return trustedScriptFromString(script);
}
/**
* Promotes the given constant string to a TrustedScriptURL.
* @param url constant string containing a trusted script URL.