From 987fbad0f30fddfcd8e59bc2c69e3217159e9f89 Mon Sep 17 00:00:00 2001 From: Naomi Black Date: Wed, 22 Jun 2016 16:43:47 -0700 Subject: [PATCH 1/7] chore(nav): clean up left nav titles and alpha-sort them --- public/docs/js/latest/guide/_data.json | 16 +++++----------- public/docs/ts/latest/cookbook/_data.json | 9 ++++++++- public/docs/ts/latest/guide/_data.json | 17 +++++------------ 3 files changed, 18 insertions(+), 24 deletions(-) diff --git a/public/docs/js/latest/guide/_data.json b/public/docs/js/latest/guide/_data.json index a0f8270eec..567324b649 100644 --- a/public/docs/js/latest/guide/_data.json +++ b/public/docs/js/latest/guide/_data.json @@ -73,11 +73,6 @@ "intro": "Learn how to apply CSS styles to components." }, - "security": { - "title": "Security", - "intro": "Prevent security vulnerabilities" - }, - "hierarchical-dependency-injection": { "title": "Hierarchical Dependency Injectors", "navTitle": "Hierarchical Injectors", @@ -115,6 +110,11 @@ "intro": "Discover the basics of screen navigation with the Angular 2 router." }, + "security": { + "title": "Security", + "intro": "Prevent security vulnerabilities" + }, + "structural-directives": { "title": "Structural Directives", "intro": "Angular has a powerful template engine that lets us easily manipulate the DOM structure of our elements." @@ -141,11 +141,5 @@ "title": "Webpack: an introduction", "intro": "Create your Angular 2 applications with a Webpack based tooling", "hide": true - }, - - "glossary": { - "title": "Glossary", - "intro": "Brief definitions of the most important words in the Angular 2 vocabulary", - "basics": true } } diff --git a/public/docs/ts/latest/cookbook/_data.json b/public/docs/ts/latest/cookbook/_data.json index f6ef392936..1d1c230763 100644 --- a/public/docs/ts/latest/cookbook/_data.json +++ b/public/docs/ts/latest/cookbook/_data.json @@ -27,10 +27,17 @@ }, "dynamic-form-deprecated": { - "title": "Dynamic Form", + "title": "Dynamic Forms", "intro": "Render dynamic forms with NgFormModel" }, + "dynamic-form": { + "title": "Dynamic Forms", + "intro": "Render dynamic forms with NgFormModel", + "basics": true, + "hide": true + }, + "set-document-title": { "title": "Set the Document Title", "intro": "Setting the document or window title using the Title service." diff --git a/public/docs/ts/latest/guide/_data.json b/public/docs/ts/latest/guide/_data.json index aee44f8f1f..f96ea364b3 100644 --- a/public/docs/ts/latest/guide/_data.json +++ b/public/docs/ts/latest/guide/_data.json @@ -78,11 +78,6 @@ "intro": "Learn how to apply CSS styles to components." }, - "security": { - "title": "Security", - "intro": "Developing for content security in Angular applications" - }, - "hierarchical-dependency-injection": { "title": "Hierarchical Dependency Injectors", "navTitle": "Hierarchical Injectors", @@ -109,7 +104,6 @@ "intro": "Pipes transform displayed values within a template." }, - "router-deprecated": { "title": "Router (Deprecated Beta)", "intro": "The deprecated Beta Router.", @@ -121,6 +115,11 @@ "intro": "Discover the basics of screen navigation with the Angular 2 Component Router." }, + "security": { + "title": "Security", + "intro": "Developing for content security in Angular applications" + }, + "structural-directives": { "title": "Structural Directives", "intro": "Angular has a powerful template engine that lets us easily manipulate the DOM structure of our elements." @@ -144,11 +143,5 @@ "webpack": { "title": "Webpack: an introduction", "intro": "Create your Angular 2 applications with a Webpack based tooling" - }, - - "glossary": { - "title": "Glossary", - "intro": "Brief definitions of the most important words in the Angular 2 vocabulary", - "basics": true } } From 1149816dce16ef0019822c04a5b77deb8b1527d3 Mon Sep 17 00:00:00 2001 From: Naomi Black Date: Wed, 22 Jun 2016 17:53:17 -0700 Subject: [PATCH 2/7] chore(nav): a missing bit of metadata for the forms guide --- public/docs/ts/latest/guide/_data.json | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/public/docs/ts/latest/guide/_data.json b/public/docs/ts/latest/guide/_data.json index f96ea364b3..8b19ebe7e8 100644 --- a/public/docs/ts/latest/guide/_data.json +++ b/public/docs/ts/latest/guide/_data.json @@ -29,6 +29,14 @@ "basics": true }, + "forms": { + "title": "Forms", + "intro": "A form creates a cohesive, effective, and compelling data entry experience. An Angular form coordinates a set of data-bound user controls, tracks changes, validates input, and presents errors.", + "nextable": true, + "basics": true, + "hide": true + }, + "forms-deprecated": { "title": "Forms", "intro": "A form creates a cohesive, effective, and compelling data entry experience. An Angular form coordinates a set of data-bound user controls, tracks changes, validates input, and presents errors.", From 3905be89ef73c41bf26084ba6650eaa3c0f54f18 Mon Sep 17 00:00:00 2001 From: Martin Probst Date: Mon, 20 Jun 2016 23:34:14 -0700 Subject: [PATCH 3/7] docs(security): Clarify template injection. Also link to html5rocks docs on CSP. --- public/docs/ts/latest/guide/security.jade | 40 ++++++++++++++--------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/public/docs/ts/latest/guide/security.jade b/public/docs/ts/latest/guide/security.jade index bfefc79095..b9e43299dd 100644 --- a/public/docs/ts/latest/guide/security.jade +++ b/public/docs/ts/latest/guide/security.jade @@ -1,6 +1,7 @@ block includes include ../_util-fns :marked + # Security Web application security has many aspects. This documentation describes Angular's built in protections against common web application vulnerabilities and attacks, such as Cross Site Scripting Attacks. It does not cover application level security, such as authentication (_Who is @@ -66,6 +67,13 @@ h2#xss Preventing Cross-Site Scripting (XSS) is inserted into the DOM from a template, via property, attribute, style, or class binding, or via interpolation, Angular will sanitize and escape untrusted values. + **Angular templates are the same as executable code**: HTML, attributes, and binding expressions + (but not the values bound!) in templates are trusted to be safe. That means applications must + prevent potentially attacker controlled values from ever making it into the source code of a + template. Never generate template source code by concatenating user input and templates! Using + the [offline template compiler](#offline-template-compiler) is an effective way to prevent these + vulnerabilities, also known as template injection. + ### Sanitization and security contexts Sanitization inspects an untrusted value and turns it into a value that is safe to insert into @@ -114,11 +122,10 @@ figure.image-display ### Content Security Policy - A [Content Security Policy (CSP)](https://developer.mozilla.org/en- - US/docs/Web/Security/CSP/Introducing_Content_Security_Policy) is a defense-in-depth technique to - prevent XSS. To enable CSP, configure your web server to return an appropriate - `Content-Security-Policy` HTTP header. Learn more at - [OWASP](https://www.owasp.org/index.php/Content_Security_Policy). + A [Content Security Policy (CSP)] + (http://www.html5rocks.com/en/tutorials/security/content-security-policy/) is a defense-in-depth + technique to prevent XSS. To enable CSP, configure your web server to return an appropriate + `Content-Security-Policy` HTTP header. ### Use the Offline Template Compiler @@ -132,11 +139,12 @@ figure.image-display ### Server side XSS protection - HTML constructed on the server is vulnerable to injection attacks. When generating server side - HTML, e.g. for the initial page load of the Angular application, make sure to use a templating - language that automatically escapes values to prevent XSS vulnerabilities on the server. Do not - generate Angular templates on the server side using a templating language, this carries a high - risk of introducing template injection vulnerabilities. + HTML constructed on the server is vulnerable to injection attacks. Injecting template code into an + Angular application is the same as injecting executable code (e.g. JavaScript) into the + application; it gives the attacker full control over the application. To prevent this, make sure + to use a templating language that automatically escapes values to prevent XSS vulnerabilities on + the server. Do not generate Angular templates on the server side using a templating language, this + carries a high risk of introducing template injection vulnerabilities. .l-main-section h2#bypass-security-apis Trusting Safe Values @@ -173,10 +181,10 @@ figure.image-display :marked If we need to convert user input into a trusted value, it can be convenient to do so in a controller method. The template below allows users to enter a YouTube video ID, and load the - corresponding video in an `