Commit Graph

200 Commits

Author SHA1 Message Date
Matt Wheatley b7b56785d1 fix(Renderer): update signatures to make RenderDebugInfo optional
The code does not force the user to provider `RenderDebugInfo`. The
current implementation lists this as a mandatory parameter. Update
the parameter to be optional.

Fixes #8466

Closes #8859
2016-05-26 10:32:03 -07:00
Victor Berchet 172a5663ef feat(platform-browser-dynamic): re-add a deprecated platform-browser-dynamic 2016-05-26 10:22:39 -07:00
Victor Berchet f4b972815b fix(platform-browser): fix rollup config 2016-05-26 10:21:24 -07:00
Vanga Sasidhar bab6023eee fix(router): Added pushState fallback for IE 9 browser.
Closes #6506

Closes #7929
2016-05-26 09:49:07 -07:00
Martin Probst 5e12a95789 test(security): test case for quoted URL values.
Test case that fixes #8701. This is already supported with the latest sanitizer
changes, but it's good to have an explicit test case.
2016-05-26 09:39:23 -07:00
Igor Minar b9347eb01c build: remove dependency on tsd and use @types/* instead 2016-05-25 16:42:28 -07:00
Igor Minar 4dbd8ed6b8 refactor: remove unnecessary annotations 2016-05-25 16:42:28 -07:00
Misko Hevery cb980d3e43 fix(ci): incorrect import 2016-05-25 16:22:55 -07:00
Misko Hevery d0a64f9c86 fix: broken build 2016-05-25 16:03:11 -07:00
Miško Hevery 39ecd01b86 chore: audit @angular/core API classification (#8808) 2016-05-25 15:00:05 -07:00
Matias Niemelä 5e0f8cf3f0 feat(core): introduce support for animations
Closes #8734
2016-05-25 13:56:50 -07:00
Igor Minar 16dfe3c63f build: consolidate tsc to ease migration to @types/ based typings delivery
I actually tried to use @types/* directly but came across several issues which prevented me
from switching over:
- https://github.com/Microsoft/TypeScript/issues/8715
- https://github.com/Microsoft/TypeScript/issues/8723
2016-05-25 08:22:07 -07:00
Alfonso Presa 5f3d02bc7c fix(Animation): Problem decimals using commas as decimal separation
Tests where failing due to `.` character being used as decimal separator in some regional settings (like spanish for example)

Closes #6335

Closes #6338
2016-05-24 21:23:46 -07:00
gdi2290 d4827caa08 refactor(DomRootRenderer): allow registeredComponents access
Closes #6584
2016-05-24 21:17:11 -07:00
Matias Niemelä 1ac38bd69a feat(renderer): add a `setElementStyles` method 2016-05-24 18:42:05 -07:00
Thierry Templier 0f0a8ade7c feat(http): automatically set request Content-Type header based on body type
Implement the ability to provide objects as request body. The following use cases
are supported:
* raw objects: a JSON payload is created and the content type set to `application/json`
* text: the text is used as it is and no content type header is automatically added
* URLSearchParams: a form payload is created and the content type set to `application/x-www-form-urlencoded`
* FormData: the object is used as it is and no content type header is automatically added
* Blob: the object is used as it is and the content type set with the value of its `type` property if any
* ArrayBuffer: the object is used as it is and no content type header is automatically added

Closes https://github.com/angular/http/issues/69

Closes #7310
2016-05-24 11:42:37 -07:00
Victor Berchet 75e6dfb9ab fix(browser): platform code cleanup 2016-05-23 17:57:28 -07:00
Victor Berchet f95a604b59 fix(bootstrap): swap coreBootstrap() and coreLoadAndBootstrap() arguments 2016-05-23 17:57:28 -07:00
Brendan Wyse fba0e2ff12 docs(browser.ts): update bootstrap injector override argument name
Closes #7387
2016-05-23 17:21:07 -07:00
Vamsi V b62415c962 refactor(chore): remove unused mapToObject and objectToMap methods from serializer
resolves #7402

Closes #7416
2016-05-23 17:20:25 -07:00
Vamsi Varikuti 0795dd307b refactor(chore): Replace all 'bindings' with 'providers'
BREAKING CHANGE

Deprecated `bindings:` and `viewBindings:` are replaced with
`providers:` and `viewProviders:`

Closes #7687
2016-05-23 13:31:08 -07:00
Andrew 33c7f74cb9 style(platform/browser): fix type spacing
Closes #7980
2016-05-20 13:05:40 -07:00
Igor Minar 0035575c82 build: turn on tsc's stripInternal when producint public d.ts file
I also made some changes to fix imports and remove some stuff that caused
breakage once stripInternals was turned on.
2016-05-20 10:59:57 -07:00
Victor Berchet e8e61de28d refactor(WebWorker): move XHR worker side 2016-05-20 10:48:55 -07:00
Victor Berchet 54f8308999 refactor(browser): merge static & dynamic platforms 2016-05-20 10:48:55 -07:00
PatrickJS 6c99746f0b Update tools.ts
Closes #8296
2016-05-20 10:12:54 -07:00
PatrickJS 4086b49046 feat(enableDebugTools): return ComponentRef
allows for 
```
bootstrap(App, [
  ...HTTP_PROVIDERS,
  ...ROUTER_PROVIDERS
])
.then(enableDebugTools)
```
without breaking the rule of always returning a value in a promise
2016-05-20 10:12:54 -07:00
Victor Berchet 6e62217b78 fix(WebWorker): remove the platform-browser dependency on compiler 2016-05-18 16:23:09 -07:00
Joost de Vries a01a54c180 adds 'repository' metadata to npm modules (#8649) 2016-05-17 23:17:15 -07:00
Martin Probst 15ae710d22 feat(security): allow url(...) style values.
Allows sanitized URLs for CSS properties. These can be abused for information
leakage, but only if the CSS rules are already set up to allow for it. That is,
an attacker cannot cause information leakage without controlling the style rules
present, or a very particular setup.

Fixes #8514.
2016-05-17 11:23:31 +02:00
Martin Probst dd50124254 feat(security): allow data: URLs for images and videos.
Allows known-to-be-safe media types in data URIs.

Part of #8511.
2016-05-17 10:57:14 +02:00
Martin Probst 50c9bed630 feat(security): expose the safe value types.
This allows users to properly type their `SafeHtml`, `SafeStyle`, etc values.

Fixes #8568.
2016-05-15 11:47:06 +02:00
Martin Probst 8b1b427195 feat(security): support transform CSS functions for sanitization.
Fixes part of #8514.
2016-05-14 13:25:45 +02:00
Marc Laval 61b339678d test(compiler): test schema generation only in Chrome
Closes #8581
2016-05-11 17:01:26 -07:00
Martin Probst 3e68b7eb1f feat(security): warn users when sanitizing in dev mode.
This should help developers to figure out what's going on when the sanitizer
strips some input.

Fixes #8522.
2016-05-09 16:46:31 +02:00
Matias Niemelä 9fbafba993 chore(parsing): change internal usage of `@` to `:` for namespaced values
Closes #8346
2016-05-09 16:20:32 +02:00
Martin Probst 7a524e3deb feat(security): add tests for URL sanitization. 2016-05-09 16:00:24 +02:00
Martin Probst 7b6c4d5acc feat(security): add tests for style sanitisation. 2016-05-09 16:00:24 +02:00
Martin Probst f86edae9f3 feat(security): add an HTML sanitizer.
This is based on Angular 1's implementation, parsing an HTML document
into an inert DOM Document implementation, and then serializing only
specifically whitelisted elements.

It currently does not support SVG sanitization, all SVG elements are
rejected.

If available, the sanitizer uses the `<template>` HTML element as an
inert container.

Sanitization works client and server-side.

Reviewers: rjamet, tbosch , molnarg , koto

Differential Revision: https://reviews.angular.io/D108
2016-05-09 16:00:24 +02:00
Igor Minar 905f38acb8 build: fix source map paths for npm packages
the bundles have source mpas disabled for now because when we downlevel
the esm bundle to es5 tsc doesn't consider the original source map so
we end up with a source map pointing to the esm bundle instead which is
not useful.
2016-05-03 13:36:33 -06:00
Martin Probst 908a102a87 feat: security implementation in Angular 2.
Summary:
This adds basic security hooks to Angular 2.

* `SecurityContext` is a private API between core, compiler, and
  platform-browser. `SecurityContext` communicates what context a value is used
  in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
  particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
  determines the security context for an attribute or property (it turns out
  attributes and properties match for the purposes of sanitization).

Based on these hooks:

* `DomSchemaElementRegistry` decides what sanitization applies in a particular
  context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
  Value*s, i.e. the ability to mark a value as safe and not requiring further
  sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
  (surprise!).

`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).

BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***

Reviewers: IgorMinar

Differential Revision: https://reviews.angular.io/D103
2016-05-03 09:21:43 -07:00
Tobias Bosch 43527172ed chore: don’t shadow `tsconfig.json` used for editors by build specific tsconfig.json 2016-05-02 15:06:46 -07:00
Misko Hevery 107016ec12 chore: router move import changes 2016-05-02 13:27:03 -07:00
Alex Eagle 3ae856ab8b build(tsc): Use angular2-template-compiler in place of tsc
This lets us down-level Decorators with tsickle and produce .metadata.json
files for users to reference when offline-compiling their app.
2016-05-01 23:40:59 -07:00
Misko Hevery 3e17c99f4e chore: clang-reformat 2016-05-01 22:59:41 -07:00
Misko Hevery cd52318f48 fix: parse browser detection lazily 2016-05-01 22:27:55 -07:00
Alex Eagle c4be30d2e8 Revert "build(tsc): Use angular2-template-compiler in place of tsc"
This reverts commit 3d25294f706e0fd6224b20372be1e961959c0af8.
2016-05-01 20:51:00 -07:00
Alex Eagle 57240c85a5 build(tsc): Use angular2-template-compiler in place of tsc
This gives us tsickle pre-processing of Decorators, and produces
.metadata.json files for users to consume in their offline compilation.
2016-05-01 20:51:00 -07:00
Igor Minar a66cdb469f repackaging: all the repackaging changes squashed 2016-05-01 20:51:00 -07:00
Igor Minar 505da6c0a8 repackaging: all the file moves 2016-05-01 20:51:00 -07:00