This is based on Angular 1's implementation, parsing an HTML document
into an inert DOM Document implementation, and then serializing only
specifically whitelisted elements.
It currently does not support SVG sanitization, all SVG elements are
rejected.
If available, the sanitizer uses the `<template>` HTML element as an
inert container.
Sanitization works client and server-side.
Reviewers: rjamet, tbosch , molnarg , koto
Differential Revision: https://reviews.angular.io/D108
When a view is destroyed, we destroy all
views in view containers and should not detach them. However, previously, we also detached them which lead to problems during the iteration loop.
Closes#8458Closes#8471
Introduced by 0c600cf6e3
the bundles have source mpas disabled for now because when we downlevel
the esm bundle to es5 tsc doesn't consider the original source map so
we end up with a source map pointing to the esm bundle instead which is
not useful.
Summary:
This adds basic security hooks to Angular 2.
* `SecurityContext` is a private API between core, compiler, and
platform-browser. `SecurityContext` communicates what context a value is used
in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
determines the security context for an attribute or property (it turns out
attributes and properties match for the purposes of sanitization).
Based on these hooks:
* `DomSchemaElementRegistry` decides what sanitization applies in a particular
context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
Value*s, i.e. the ability to mark a value as safe and not requiring further
sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
(surprise!).
`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).
BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***
Reviewers: IgorMinar
Differential Revision: https://reviews.angular.io/D103
Impure pipes need to live on the view
that used them and need a new instance for
each call site.
Impure pipes need to live on the component view, cached across all child views,
and need a new pure proxy for each for
each call site that lives on the view
of the call site.
Fixes#8408
This bug was introduced not long ago by 152a117d5c
Before, we would create all fields in the generated views
with visibility `private`. This does not work if an embedded
view references a directive / element in a parent view.
In Dart, this was no problem so far as it does not have
a `private` modifier.
Before, `useValue` in a provider did not work when doing
offline compile, as so far the `MetadataResolver` was only
used for jit mode. Now, `useValue` supports any kind of value
that the static reflector can return. E.g. primitives,
arrays, string maps, …
Closes#8366
Most of the bugs discovered so far in the offline compiler were related to the StaticReflector. As it was part of angular2 core, it was hard to update. Moving it into the compiler_cli allows to release more often until the compiler_cli gets more stable.
Note: Moving the unit test next to the sources is the simplest option for now in terms of build setup.
Note: This commit only does the move. The next commit updates the build to run it again.
This change adds providers for fake router dependecies.
This allows TestComponentBuilder to create components with RouterLink and RouterOutlet directives
without the test writer needing to override them.
BREAKING CHANGE:
- ViewRef.changeDetectorRef was removed as using ChangeDetectorRefs
for EmbeddedViewRefs does not make sense. Use ComponentRef.changeDetectorRef
or inject ChangeDetectorRef instead.
Fixes#8242
The previous code that had `try/catch` statements in methods could not be optimized by Chrome.
This change separates `AppView` (no `try/catch`) form `DebugAppView` (always `try/catch`). Our codegen will use `AppView` in production mode and `DebugAppView` in debug mode.
Closes#8338
BREAKING CHANGE:
- `DynamicComponentLoader` is deprecated. Use `ComponentResolver` and `ViewContainerRef` directly.
- `DebugNode.inject` is deprecated. use `DebugNode.injector.get` instead.
BREAKING CHANGE:
- Before, a `EmbeddedViewRef` used to have methods for
setting variables. Now, a user has to pass in a context
object that represents all variables when an `EmbeddedViewRef`
should be created.
- `ViewContainerRef.createEmbeddedViewRef` now takes
a context object as 2nd argument.
- `EmbeddedViewRef.setLocal` and `getLocal` have been removed.
Use `EmbeddedViewRef.context` to access the context.
- `DebugNode.locals` has been removed. Use the new methods `DebugElement.references`
to get the references that are present on this element,
or `DebugElement.context` to get the context of the `EmbeddedViewRef` or the component to which the element belongs.
Closes#8321
These worked in Dart because they were effectively exported even without the export keyword.
Without exporting these symbols, they are not produced in .metadata.json files, which leaves
dangling references from the Decorators that use them.
Instantiating the test component within an NgZone will let us track async tasks in event handlers and change detection.
We can also do auto change detection when triggering events through dispatchEvent and not have to do fixture.detectChange() manually in the test.
New API:
ComponentFixture.autoDetectChanges() - This puts the fixture in auto detect mode that automatically calls detectChanges when the microtask queue is empty (Similar to how change detection is triggered in an actual application).
ComponentFixture.isStable() - This returns a boolean whether the fixture is currently stable or has some async tasks that need to be completed.
ComponentFixture.whenStable() - This returns a promise that is resolved when the fixture is stable after all async tasks are complete.
Closes#8301
The filename contains the module name as resolved by users, so the top-level module name is uneeded.
Module names on references are replaced by capturing the import syntax from the module.
This allows readers of the metadata to do the module resolution themselves.
Fixes#8225Fixes#8082Closes#8256
Remove FunctionWithParamTokens.
All test wrappers async, fakeAsync and inject now return just a Function instead of FunctionWithParamTokens. This makes them directly consumable by the test framework. Also the test framework code does not have to handle a union of Function and FunctionWithParamTokens everywhere.
The Function returned by the above methods are considered asynchronous by the test framework if they return a Promise, synchronous otherwise.
Closes#8257
Introduces `ref-` to give a name to an element or a directive (also works for `<template>` elements), and `let-` to introduce an input variable for a `<template>` element.
BREAKING CHANGE:
- `#...` now always means `ref-`.
- `<template #abc>` now defines a reference to the TemplateRef, instead of an input variable used inside of the template.
- `#...` inside of a *ngIf, … directives is deprecated.
Use `let …` instead.
- `var-...` is deprecated. Replace with `let-...` for `<template>` elements and `ref-` for non `<template>` elements.
Closes#7158Closes#8264
When a component uses a list of directives, such as `ROUTER_DIRECTIVES`,
make `TestComponentBuilder#overrideDirective` work properly for members
of the list.
Closes#7397Closes#8217
Pure pipes as well as arrays and maps are
implemented via proxy functions. This is
faster than the previous implementation
and also generates less code.
BREAKING CHANGE:
- pipes now take a variable number of arguments, and not an array that contains all arguments.
Update the version of zone.js to @0.6.12 that contains the new FakeAsyncTestZoneSpec.
The new fakeAsync zone handles errors better and clearPendingTimers() is no longer required to be called after handling an error and is deprecated.
The fakeAsync test zone will now throw an error if an XHR is attemtped within the test since that cannot be controlled synchronously in the test(Need to be mocked out with a service implementation that doesn't involve XHRs).
This commit also allows fakeAsync to wrap inject to make it consistent with async test zone.
BREAKING CHANGE:
inject can no longer wrap fakeAsync while fakeAsync can wrap inject. So the order in existing tests with inject and fakeAsync has to be switched as follows:
Before:
```
inject([...], fakeAsync((...) => {...}))
```
After:
```
fakeAsync(inject([...], (...) => {...}))
```
Closes#8142
This changes Angular so that it can be used without reflection (assuming a codegen for injectors).
BREAKIKNG CHANGE:
- Drops `APP_COMPONENT` provider. Instead, inject
`ApplicationRef` and read its `componentTypes` property.
- long form bootstrap has changed into the following:
```
var platform = createPlatform(ReflectiveInjector.resolveAndCreate(BROWSER_PROVIDERS));
var appInjector =
ReflectiveInjector.resolveAndCreate([BROWSER_APP_PROVIDERS, appProviders], platform.injector);
coreLoadAndBootstrap(appInjector, MyApp);
```
BREAKING CHANGE:
- Injector was renamed into `ReflectiveInjector`,
as `Injector` is only an abstract class with one method on it
- `Injector.getOptional()` was changed into `Injector.get(token, notFoundValue)`
to make implementing injectors simpler
- `ViewContainerRef.createComponent` now takes an `Injector`
instead of `ResolvedProviders`. If a reflective injector
should be used, create one before calling this method.
(e.g. via `ReflectiveInjector.resolveAndCreate(…)`.
This adds the feature for `@ViewChild`/`@ViewChildren`/`@ContentChild`/`@ContentChildren` to define what to read from the queried element.
E.g. `@ViewChild(`someVar`, read: ViewContainerRef)` will locate the element with a variable `someVar` on it and return a `ViewContainerRef` for it.
Background: With this change, Angular knows exactly at which elements there will be `ViewConainerRef`s as the user has to ask explicitly of them. This simplifies codegen and will make converting Angular templates into server side templates simpler as well.
BREAKING CHANGE:
- `DynamicComponentLoader.loadIntoLocation` has been removed. Use `@ViewChild(‘myVar’, read: ViewContainerRef)` to get hold of a `ViewContainerRef` at an element with variable `myVar`.
- `DynamicComponentLoader.loadNextToLocation` now takes a `ViewContainerRef` instead of an `ElementRef`.
- `AppViewManager` is renamed into `ViewUtils` and is a mere private utility service.
Each compile template now exposes a `<CompName>NgFactory` variable
with an instance of a `ComponentFactory`.
Calling `ComponentFactory.create` returns a `ComponentRef` that can
be used directly.
BREAKING CHANGE:
- `Compiler` is renamed to `ComponentResolver`,
`Compiler.compileInHost` has been renamed to `ComponentResolver.resolveComponent`.
- `ComponentRef.dispose` is renamed to `ComponentRef.destroy`
- `ViewContainerRef.createHostView` is renamed to `ViewContainerRef.createComponent`
- `ComponentFixture_` has been removed, the class `ComponentFixture`
can now be created directly as it is no more using private APIs.
closes https://github.com/angular/angular/issues/4943
BREAKING CHANGE:
`Location` and other related providers have been moved out of `router` and into `platform/common`. `BrowserPlatformLocation` is not meant to be used directly however advanced configurations may use it via the following import change.
Before:
```
import {
PlatformLocation,
Location,
LocationStrategy,
HashLocationStrategy,
PathLocationStrategy,
APP_BASE_HREF}
from 'angular2/router';
import {BrowserPlatformLocation} from 'angular2/src/router/location/browser_platform_location';
```
After:
```
import {
PlatformLocation,
Location,
LocationStrategy,
HashLocationStrategy,
PathLocationStrategy,
APP_BASE_HREF}
from 'angular2/platform/common';
import {BrowserPlatformLocation} from 'angular2/src/platform/browser/location/browser_platform_location';
```
Closes#7962
Instead of using injectAsync and returning a promise, use the `async` function
to wrap tests. This will run the test inside a zone which does not complete
the test until all asynchronous tasks have been completed.
`async` may be used with the `inject` function, or separately.
BREAKING CHANGE:
`injectAsync` is now deprecated. Instead, use the `async` function
to wrap any asynchronous tests.
Before:
```
it('should wait for returned promises', injectAsync([FancyService], (service) => {
return service.getAsyncValue().then((value) => { expect(value).toEqual('async value'); });
}));
it('should wait for returned promises', injectAsync([], () => {
return somePromise.then(() => { expect(true).toEqual(true); });
}));
```
After:
```
it('should wait for returned promises', async(inject([FancyService], (service) => {
service.getAsyncValue().then((value) => { expect(value).toEqual('async value'); });
})));
// Note that if there is no injection, we no longer need `inject` OR `injectAsync`.
it('should wait for returned promises', async(() => {
somePromise.then() => { expect(true).toEqual(true); });
}));
```
Closes#7735
BREAKING CHANGE:
- Renderer:
* renderComponent method is removed form `Renderer`, only present on `RootRenderer`
* Renderer.setDebugInfo is removed. Renderer.createElement / createText / createTemplateAnchor
now take the DebugInfo directly.
- Query semantics:
* Queries don't work with dynamically loaded components.
* e.g. for router-outlet: loaded components can't be queries via @ViewQuery,
but router-outlet emits an event `activate` now that emits the activated component
- Exception classes and the context inside changed (renamed fields)
- DebugElement.attributes is an Object and not a Map in JS any more
- ChangeDetectorGenConfig was renamed into CompilerConfig
- AppViewManager.createEmbeddedViewInContainer / AppViewManager.createHostViewInContainer
are removed, use the methods in ViewContainerRef instead
- Change detection order changed:
* 1. dirty check component inputs
* 2. dirty check content children
* 3. update render nodes
Closes#6301Closes#6567
Reflector always returns either an empty object or an empty list if no
metadata is recorded for the class. StaticReflector matches this
behavior.
Closes#7986
using "/// <reference" is incorrect because it makes our code non-portable. The correct solution is to provide
these typings as ambient typings as an additional entry point - which we already do.
Closes#8050
In Dart, ImmutableLists are just a projection of an underlying list.
I.e. if the underlying list changes, the ImmutableList also changes.
So we can't make optimizations based on checking whether a collection
is an ImmutableList.
This reverts commit a10c02cb41.
Closes#8023
Useful for avoiding doing an actual XHR during testing.
Part of the solution for #4051 (Other part is a Karma plugin that will create the template cache).
Closes#7940
Added a static reflector that uses metadta produced during build
or, additionally, directly from typescript, to produce the metadata
used by Angular code generation compiler.
Add a check in ReflectionCapabilities#interfaces which determines if
the passed-in type implements a Lifecycle Interface but does not declare
that it does so.
See https://goo.gl/b07Kii for details.
Closes#6849
fixes#6303
BREAKING CHANGE:
For static content projection, elements with *-directives are now matched against the element itself vs the template before.
<p *ngIf="condition" foo></p>
Before:
// Use the implicit template for projection
<ng-content select="template"></ng-content>
After:
// Use the actual element for projection
<ng-content select="p[foo]"></ng-content>
Closes#7742
Before, you'd get an error like:
```
EXCEPTION: Cannot find a differ supporting object ‘[object Object]’ in [users in UsersCmp@2:14]
```
Now, you get:
```
EXCEPTION: Cannot find a differ supporting object ‘[object Object]’ of type 'Object'. Did you mean to bind ngFor to an Array? in [users in UsersCmp@2:14]
```
At the moment ng-link is generating html5mode URLs for `href`s.
Instead it should check whether or not html5mode is enabled and create
the `href`s accordingly. The renaming in the `getLink` function is
aligning it to `RouterLink`'s `_updateLink`.
Closes#7423
Update the Angular 2 transformer to recognize
`package:angular2/platform/browser.dart` as the library which exports
the `bootstrap` function.
Update playground, examples, benchmarks, & tests to import bootstrap from
platform/browser.
Closes#7647
Change the old public api spec to check only the exported top-level symbols. This will make sure that Dart and JS do not diverge. The new public api spec verifies the TS api.
Closes#7447
TL;DR: Modify pubspec.yaml files to use the recommended "targeted"
transformers. The unified "simple" angular2 transformer still works as
always, but we want to encourage use of the targeted transformers
whereever possible.
See [the wiki](https://github.com/angular/angular/wiki/Advanced-Transformer-Configuration)
for details about targeted transformers.
See #1872
Until Angular 1.5.1 is released, the `$routeConfig` and `$routerCanActivate`
annotations for components must live on the controller constructor.
In Angular 1.5.1, it will automatically copy these annotations across from
the component definition file.
Closes#7319
These tests were registering new components after the application had
been bootstrapped, which is not a valid use case for synchronous routes
in Angular 1.
In particular it was registering the "root" component, which caused the
`$rootRouter` to blow up, when it was instantiated, pointing to a root
component that did not yet exist.
The directiveIntrospector was a bit of a hack to allow the router to
read the `$routeConfig` annocation and `$routerCanActivate` hook from
directives when they were registered.
It turns out that if we put these properties on the component controller's
constructor function (i.e. as static class methods) then we can simply
use the `$injector` to access it as required.
Currently, people put the properties directly on their component definition
objects. In Angular 1.5.1, we will copy these properties onto the controller
constructor to maintain a simple migration path. But going forward it may be
better to encourage people to add the properties directly to the controller
constructor.
Create transformers that allow specifying transformer actions on
specific libraries.
* angular2/transform/codegen: Generates all necessary code.
* angular2/transform/reflection_rewriter: Replaces `bootstrap` calls in
application entry points to remove transitive dart:mirrors import,
resulting in smaller code size & faster execution.
* angular2/transform/deferred_rewriter: Rewrites deferred imports and
`loadLibrary` calls to initialize Angular2 and preserve deferred
operation.
Proper configuration of these three transformers can replace the single
angular2 transformer, resulting in significant performance gains for
builds of large angular2 apps.
Update angular2 itself to declare the codegen transformer, since it has
neither deferred imports nor application entry points.
Remove the undocumented & unused quick_transformer.
Instead of running with karma and the karma-dart shim, run dart
tests directly using the new package:test runner. This migrates
away from package:unittest.
Fixes a couple tests, mostly associated with depending on absolute
URLs or editing the test providers after an injector had already
been created.
Remove karma-dart and associated files. Change gupfiles to run tests
via `pub run test` instead.
Add a check in `ReflectionCapabilities#interfaces` which determines if
the passed-in type implements a Lifecycle Interface but does not declare
that it does so.
See https://goo.gl/b07Kii for details.
Closes#6849
Remove couple of circular dependency between modules in Angular 2 ES5 output caused by exception_handler.ts and router_providers.ts.
Fix the build/checkCircularDependency gulp task to call madge properly to detect the circular deps.
Closes#7287
@petebacondarwin deserves credit for most of this commit.
This allows you to specify a regex and serializer function instead
of the path DSL in your route declaration.
```
@RouteConfig([
{ regex: '[a-z]+.[0-9]+',
serializer: (params) => `{params.a}.params.b}`,
component: MyComponent }
])
class Component {}
```
Closes#7325Closes#7126
The current router is passed to the current component via a binding.
To indicate that this is an angular provided object, this commit
renames the binding to `$router`.
BREAKING CHANGE:
The recently added binding of the current router to the current component
has been renamed from `router` to `$router`.
So now the recommended set up for your bindings in your routed component
is:
```js
{
...
bindings: {
$router: '<'
}
}
```
The current router is passed to the current component via a binding.
To indicate that this is an angular provided object, this commit
renames the binding to `$router`.
BREAKING CHANGE:
The recently added binding of the current router to the current component
has been renamed from `router` to `$router`.
So now the recommended set up for your bindings in your routed component
is:
```js
{
...
bindings: {
$router: '<'
}
}
```
BREAKING CHANGE:
`OnPushObserve` was an experimental
feature for Dart and had
conceptual performance problems,
as setting up observables is slow.
Use `OnPush` instead.
BREAKING CHANGE:
In Dart we used to support injecting types with generics. As this feature is hard to implement with the upcoming codegen we are dropping it.
Merge cl/115454020 in G3 with this change.
Closes#7262
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
feat(pipes): add ReplacePipe for string manipulation
add commonly used pipe that is missing from framework.
Adding static pattern validation method to Validators
Adding a directive for the pattern validator
Applying clang-format rules to modified files
Updating public api spec for new pattern validator
Adding pattern validator to public api guard tool
For #5411Closes#5561
The singleton service that represents the top level router was called
`$router` but this is confusing since there are actually lots of routers,
which depend upon where you are in the DOM. This is similar to the situation
with scopes.
This commit clarifies this singleton by renaming it to `$rootRouter`.
BREAKING CHANGE:
The `$router` injectable service has been renamed to `$rootRouter`
The current router is passed to the current component via a binding.
To indicate that this is an angular provided object, this commit
renames the binding to `$router`.
BREAKING CHANGE:
The recently added binding of the current router to the current component
has been renamed from `router` to `$router`.
So now the recommended set up for your bindings in your routed component
is:
```js
{
...
bindings: {
$router: '<'
}
}
```
Despite local testing, multiple users failed to run the postinstall to install typings.
Instead, we can distribute the typings we installed locally.
This is an alternative to #7003.
This also reverts rxjs to beta.1 since we have errors using beta.2, being addressed
in #7001.
Fixes#7000
Currently, validators extending built-in validators are treated as built-in.
This can result in an error when both a real built-in validator and a custom one are applied to the same element.
Closes#6981
Url path of star segments should equal the original path.
If you register the route `/app/*location` and invoke a url like `/app/foo/bar`
the PathRecognizer should return a url path equal to the invoked url.
Before this patch, everything after `foo` was ignored, which resulted in a
redirect to `/app/foo` which was probably not intended (at least in the angular
1.5 component router).
Closes#6976
In angular2 `Location.path()` returns the complete path including query string. In angular1 the query parameters are missing. Similar to this `Location.go` does accept two parameters (path *and query*).
Closes#6943
In Angular 1.5 there is a new helper method for creating component directives.
See https://docs.angularjs.org/guide/component for more information about components.
These kind of directives only match the `E` element form and the previously component
router only created HTML that matched directives that matched the `A` attribute form.
This commit changes the `<ng-outlet>` directive so that it generates custom HTML
elements rather divs with custom attributes to trigger the relevant component to
appear in the DOM.
Going forward, Angular 1.5 users are encouraged to create their router components
using the following style:
```
myModule.componnet('component-name', {
// component definition object
});
```
Closes angular/angular.js#13860
Closes#6076Closes#5278
BREAKING CHANGE:
The component router now creates custom element HTML rather than custom attribute
HTML, in order to create a new component. So rather than
```html
<div custom-component></div>
```
it now creates
```html
<custom-component></custom-component>
```
If you defined you router components using the `directive()` helper and
specified the `restrict` properties such that element matching was not allowed,
e.g. `restrict: 'A'` then these components will no longer be instantiated
by the component router and the outlet will be empty.
The fix is to include `E` in the `restrict` property.
`restrict: 'EA'`
Note that this does not affect directives that did not specify the `restrict`
property as the default for this property is already `EA`.
This resolves Duplicate Identifier issues seen by many users,
at the expense of more typings installation required in some
cases.
Removes the quickstart hack of placing all needed dependencies
typings files in our distribution. Removes dependencies on
nodejs from angular2/core.
Fixes#5973Fixes#5807Fixes#6266
Angular now depends on es6-promise and es6-collections
(and a handful of manual typings) rather than all of es6-shim.
Fixes#5242
We previously had an undocumented breaking change, this is now
documented in this commit.
Fixes#6817
BREAKING CHANGE:
Transitive typings are no longer included in the distribution.
You may need to install typings in your project using
http://github.com/typings/typings
Users now must rely on getting typings from:
- one of the peerDependencies, such as rxjs, which exposes
typings via the moduleResolution=node mechanism.
(see https://github.com/Microsoft/TypeScript/wiki/Typings-for-npm-packages)
This happens automatically.
- Using --target ES5 now requires manual installation of
es6-promise and es6-collections typings.
- Using some angular APIs may introduce a dependency on eg. nodejs
or jasmine, and those typings need manual installation as well.
Closes#6267
The upstream Jasmine typings don't define a type for the global
object with Jasmine methods polluting it, so just use any.
Also zone.js has a different name upstream.