honeymoose
/
angular-cn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(security): document <iframe src> to be TRUSTED_URL. 

Docs on the DomSanitizationService didn't match actual usage before.

Also fixes some minor docs and implementation issues.
This commit is contained in:
Martin Probst 2016-06-02 17:50:58 -07:00
parent e213939f28
commit 346304762e
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
modules/@angular/platform-browser/src/security/dom_sanitization_service.ts
View File

@ -81,7 +81,7 @@ export abstract class DomSanitizationService implements SanitizationService {
/**
* Bypass security and trust the given value to be a safe style URL, i.e. a value that can be used
* in hyperlinks or `<iframe src>`.
* in hyperlinks or `<img src>`.
*
* WARNING: calling this method with untrusted user data will cause severe security bugs!
*/
@ -89,11 +89,11 @@ export abstract class DomSanitizationService implements SanitizationService {
/**
* Bypass security and trust the given value to be a safe resource URL, i.e. a location that may
* be used to load executable code from, like `<script src>`.
* be used to load executable code from, like `<script src>`, or `<iframe src>`.
*
* WARNING: calling this method with untrusted user data will cause severe security bugs!
*/
abstract bypassSecurityTrustResourceUrl(value: string): any /** TODO #9100 */;
abstract bypassSecurityTrustResourceUrl(value: string): SafeResourceUrl;
}
@ -133,7 +133,7 @@ export class DomSanitizationServiceImpl extends DomSanitizationService {
private checkNotSafeValue(value: any, expectedType: string) {
if (value instanceof SafeValueImpl) {
throw new Error('Required a safe ' + expectedType + ', got a ' + value.getTypeName());
throw new Error(`Required a safe ${expectedType}, got a ${value.getTypeName()}`);
}
}