Allow more elements and attributes from the HTML5 spec which were stripped by the htmlSanitizer.
fixes#9438
feat(security): allow audio data URLs in urlSanitizer
test(security) : add test for valid audio data URL
feat(security): allow and sanitize srcset attributes
test(security): test for srcset sanitization
Instead, the async function now determines whether it should return a promise
or instead call a done function parameter. Importing Jasmine functions
from `@angular/core/testing` is no longer necessary and is now deprecated.
Additionally, beforeEachProviders is also deprecated, as it is specific
to the testing framework. Instead, use the new addProviders method directly.
Before:
```js
import {beforeEachProviders, it, describe, inject} from 'angular2/testing/core';
describe('my code', () => {
beforeEachProviders(() => [MyService]);
it('does stuff', inject([MyService], (service) => {
// actual test
});
});
```
After:
```js
import {addProviders, inject} from 'angular2/testing/core';
describe('my code', () => {
beforeEach(() => {
addProviders([MyService]);
});
it('does stuff', inject([MyService], (service) => {
// actual test
});
});
```
TestComponentBuilder now lives in core/testing. compiler/testing contains a private
OverridingTestComponentBuilder implementation which handles the private behavior
we need to override templates. This is part of the effort to simplify the testing
imports and hide compiler APIs.
Closes#9585
BREAKING CHANGE:
`TestComponentBuilder` is now imported from `@angular/core/testing`. Imports
from `@angular/compiler/testing` are deprecated.
Before:
```
import {TestComponentBuilder, TestComponentRenderer, ComponentFixtureAutoDetect} from '@angular/compiler/testing';
```
After:
```
import {TestComponentBuilder, TestComponentRenderer, ComponentFixtureAutoDetect} from '@angular/core/testing';
```
BREAKING CHANGE:
MockLocationStrategy was intended to be internal only and is now removed
from the `@angular/common/testing` public api.
Use `SpyLocation` from `@angular/common/testing` for location testing.
BREAKING CHANGE:
`ComponentFixture` will be moving out of `@angular/compiler/testing` to `@angular/core/testing` in
this release. For now, it is deprecated from `@angular/compiler/testing`.
Previously, we were exporting internal mocks and helpers. Move these
to core/testing/testing_internal or remove them if they were
never used.
Remove deprecated items - injectAsync, clearPendingTimers.
BREAKING CHANGE:
Remove the following APIs from `@angular/core/testing`, which have been deprecated or were
never intended to be publicly exported:
```
injectAsync
clearPendingTimers
Log
MockAppliacationHref
MockNgZone
clearPendingTimers
getTypeOf
instantiateType
```
Instead of `injectAsync`, use `async(inject())`.
`clearPendingTimers` is no longer required.
Mostly, removing things that were never intended to be exported publicy.
BREAKING CHANGE:
The following are no longer publicly exported APIs. They were intended as internal
utilities and you should use your own util:
```
browserDetection,
dispatchEvent,
el,
normalizeCSS,
stringifyElement,
expect (and custom matchers for Jasmine)
```
The DOM schema does not allow binding any properties to dangerous SVG
attributes/properties. This change adds a smoke test to verify that
behaviour, by testing that `xlink:href` (a sample dangerous property)
is not bindable.
Fixes#9510.
E.g. in the following scenario,
`some-directive` should not be able to inject
any view provider that `my-comp-with-view-providers`
declares.
```
<my-comp-with-view-providers>
<div some-directive></div>
</my-comp-with-view-providers>
```
Alex Eagle
vsavkin
Jason Choi
Martin Probst
Cyrille Tuzi
Gion Kunz
Kai Ruhnau
choeller
Marek Buko
Jesús Rodríguez
Kara Erickson
Julie Ralph
Victor Berchet
Jeff Cross
Igor Minar
Wojciech Kwiatek
Tobias Bosch
Pawel Kozlowski