Commit Graph

525 Commits

Author SHA1 Message Date
Martin Probst 2d9d7f1310 fix(security): allow empty CSS values. (#9675) 2016-06-28 11:45:02 -07:00
Victor Berchet 5ee84fe0f6 refactor: add types (#9606)
relates to #9100
2016-06-28 11:35:59 -07:00
Jeff Cross 1620426393 fix(http): don't encode values that are allowed in query (#9651)
This implements a new class, QueryEncoder, that provides
methods for encoding keys and values of query parameter.
The encoder encodes with encodeURIComponent, and then
decodes a whitelist of allowed characters back to their
unencoded form.

BREAKING CHANGE:

The changes to Http's URLSearchParams serialization now 
prevent encoding of these characters inside query parameters
which were previously converted to percent-encoded values:

@ : $ , ; + ; ? /

The default encoding behavior can be overridden by extending
QueryEncoder, as documented in the URLSearchParams service.

Fixes #9348
2016-06-28 11:31:35 -07:00
Tobias Bosch bf598d6b8b feat(compiler): support sync runtime compile
Adds new abstraction `Compiler` with methods
`compileComponentAsync` and `compileComponentSync`.
This is in preparation of deprecating `ComponentResolver`.

`compileComponentSync` is able to compile components
synchronously given all components either have an inline
template or they have been compiled before.

Also changes `TestComponentBuilder.createSync` to
take a `Type` and use the new `compileComponentSync` method.

Also supports overriding the component metadata even if
the component has already been compiled.

Also fixes #7084 in a better way.

BREAKING CHANGE:
`TestComponentBuilder.createSync` now takes a component type
and throws if not all templates are either inlined
are compiled before via `createAsync`.

Closes #9594
2016-06-28 10:26:16 -07:00
Igor Minar 24eb8389d2 fix: public api surface fixes + stability markers
- ts-api-guardian will now error if a new public symbol is added with a stability marker (`@stable`, `@experimental`, `@deprecated`)
- DomEventsPlugin and KeyEventsPlugin were removed from public api surface - these classes is an implementation detail
- deprecated BROWSER_PROVIDERS was removed completely
- `@angular/compiler` was removed from the ts-api-guardian check since this package shouldn't contain anything that users need to directly import
- the rest of the api surface was conservatively marked as stable or experimental

BREAKING CHANGES: DomEventsPlugin and KeyEventsPlugin previously exported from core are no longer public - these classes are implementation detail.

Previously deprecated BROWSER_PROVIDERS was completely removed from platform-browser.

Closes #9236
Closes #9235
Ref #9234
2016-06-28 07:39:40 -07:00
vsavkin fcfddbf79c feat(router): add pathMatch property to replace terminal 2016-06-27 20:21:30 -07:00
vsavkin dc64e90ab9 feat(router): use componentFactoryResolver 2016-06-27 20:21:30 -07:00
vsavkin e12b1277df feat(core): split ChangeDetectorStrategy into ChangeDetectionStrategy and ChangeDetectorStatus 2016-06-27 20:19:20 -07:00
Kara 797914e948 fix(forms): emit statusChange when child controls have async validator (#9652) 2016-06-27 21:01:24 -06:00
Matias Niemelä e0b0a594bb fix(animations): ensure void => * animations are triggered when an expression is omitted
Closes #9327
Closes #9381
2016-06-27 18:55:10 -07:00
Kara ed0ade6f34 fix(forms): make radio button selection logic more flexible (#9646)
Closes #9558
2016-06-27 15:29:33 -06:00
Tobias Bosch 5cc7b41f39 Revert "fix(Compiler): relax childIsRecursive check (#8705)"
This fix prevented waiting for child components even if the cycle was only introduced via the `directives` array, i.e. without actually having a cycle. This easily causes issues for applications that have one shared list of directives for all components.

This reverts commit 3d5bb23184.

Closes #9647
2016-06-27 14:27:03 -07:00
vsavkin f2f1ec0117 feat(router): implement data and resolve 2016-06-27 14:25:56 -07:00
Alex Eagle e913d9954d chore(typings): restrict Angular to es5+collections+promise 2016-06-27 13:58:59 -07:00
vsavkin d20488752b fix(router): top-levels do not work in ngIf 2016-06-27 13:34:54 -07:00
vsavkin 855f3afb28 fix(router): canceled navigations should return a promise that is resolved with false 2016-06-27 13:34:54 -07:00
vsavkin 3f44377f2f fix(router): handle empty path with query params 2016-06-27 13:34:54 -07:00
vsavkin 90295e3252 fix(router): preserve fragment on initial load 2016-06-27 13:34:54 -07:00
Martin Probst db66509e66 test(security): tests for HTML5 elements, srcset.
Part of #9572.
2016-06-27 12:19:03 -07:00
Cyrille Tuzi 6605eb30e9 feat(security): allow more HTML5 elements and attributes in sanitizers
Allow more elements and attributes from the HTML5 spec which were stripped by the htmlSanitizer.

fixes #9438

feat(security): allow audio data URLs in urlSanitizer

test(security) : add test for valid audio data URL

feat(security): allow and sanitize srcset attributes

test(security): test for srcset sanitization
2016-06-27 12:19:03 -07:00
Gion Kunz 3644eef860 feat(DomRenderer): Adding support for document fragments in SVG foreign objects (#9458) 2016-06-27 08:26:45 -07:00
choeller eef9512ce6 fix(forms): async validator-directives process Observables correctly (#8186)
Closes #/8022
2016-06-26 16:52:50 -06:00
Marek Buko 9f00a1b902 fix(forms): add select multiple accessor as built-in accessor 2016-06-26 16:24:27 -06:00
Jesús Rodríguez c369bc747d docs: update cheatsheet import lines (#9614) 2016-06-26 07:31:35 -07:00
Kara Erickson c03e1f2f59 feat(forms): add support for formArrayName
Closes #9251
2016-06-25 13:30:53 -07:00
Kara Erickson 17dcbf66b9 feat(forms): expose ValidatorFn and AsyncValidatorFn
Closes #8834
2016-06-24 18:24:11 -07:00
Julie Ralph 40b907a657 refactor(testing): remove wrapping of Jasmine functions (#9564)
Instead, the async function now determines whether it should return a promise
or instead call a done function parameter. Importing Jasmine functions
from `@angular/core/testing` is no longer necessary and is now deprecated.

Additionally, beforeEachProviders is also deprecated, as it is specific
to the testing framework. Instead, use the new addProviders method directly.

Before:
```js
import {beforeEachProviders, it, describe, inject} from 'angular2/testing/core';

describe('my code', () => {
  beforeEachProviders(() => [MyService]);

  it('does stuff', inject([MyService], (service) => {
    // actual test
  });
});
```

After:
```js
import {addProviders, inject} from 'angular2/testing/core';

describe('my code', () => {
  beforeEach(() => {
    addProviders([MyService]);
  });

  it('does stuff', inject([MyService], (service) => {
    // actual test
  });
});
```
2016-06-24 17:48:35 -07:00
Julie Ralph a33195dcf3 fix(core/testing compiler/testing): move TestComponentBuilder to core/testing (#9590)
TestComponentBuilder now lives in core/testing. compiler/testing contains a private
OverridingTestComponentBuilder implementation which handles the private behavior
we need to override templates. This is part of the effort to simplify the testing
imports and hide compiler APIs.

Closes #9585

BREAKING CHANGE:

`TestComponentBuilder` is now imported from `@angular/core/testing`. Imports
from `@angular/compiler/testing` are deprecated.

Before:

```
import {TestComponentBuilder, TestComponentRenderer, ComponentFixtureAutoDetect} from '@angular/compiler/testing';
```

After:
```
import {TestComponentBuilder, TestComponentRenderer, ComponentFixtureAutoDetect} from '@angular/core/testing';
```
2016-06-24 17:35:01 -07:00
Kara Erickson de127109f9 feat(forms): make valueChanges and statusChanges available on abstract control directives 2016-06-24 14:37:19 -07:00
vsavkin 83208983b3 chore(router): bump up version number 2016-06-24 13:07:42 -07:00
vsavkin 327d04c9c6 chore(router): clang-format 2016-06-24 12:44:32 -07:00
vsavkin 54edce2bab fix(router): wildcard don't get notified on url changes 2016-06-24 12:44:32 -07:00
vsavkin 1a145ac500 fix(router): default exact to false in routerLinkActiveOptions 2016-06-24 12:44:32 -07:00
vsavkin 9f978cf49d test(router): add a test checking that you can use a slash in query params 2016-06-24 12:44:32 -07:00
vsavkin 41b781107b fix(router): doen't throw on canDeactive when route hasn't advanced 2016-06-24 12:44:32 -07:00
Julie Ralph dcf75126bf fix(common/testing): remove internal MockLocationStrategy from common/testing (#9562)
BREAKING CHANGE:

MockLocationStrategy was intended to be internal only and is now removed
from the `@angular/common/testing` public api.

Use `SpyLocation` from `@angular/common/testing` for location testing.
2016-06-24 12:41:57 -07:00
Julie Ralph 1143b0389a fix(core/testing): move ComponentFixture to core (#9386)
BREAKING CHANGE:

`ComponentFixture` will be moving out of `@angular/compiler/testing` to `@angular/core/testing` in
this release. For now, it is deprecated from `@angular/compiler/testing`.
2016-06-24 12:41:49 -07:00
Kara Erickson 97a2119596 fix(forms): ngModel should emit valueChanges and statusChanges asynchronously 2016-06-24 12:37:46 -07:00
vsavkin fbd2dd9ca2 fix(router): handle path:'' redirects and matches 2016-06-24 11:39:41 -07:00
Julie Ralph 8a9e9c7bd3 fix(core/testing): clean up the core testing public API (#9466)
Previously, we were exporting internal mocks and helpers. Move these
to core/testing/testing_internal or remove them if they were
never used.

Remove deprecated items - injectAsync, clearPendingTimers.

BREAKING CHANGE:

Remove the following APIs from `@angular/core/testing`, which have been deprecated or were
never intended to be publicly exported:

```
injectAsync
clearPendingTimers
Log
MockAppliacationHref
MockNgZone
clearPendingTimers
getTypeOf
instantiateType
```

Instead of `injectAsync`, use `async(inject())`.

`clearPendingTimers` is no longer required.
2016-06-23 17:10:22 -07:00
Julie Ralph 3d8eb8cbca fix(platform-browser/testing): clean up public api for platform-browser/testing (#9519)
Mostly, removing things that were never intended to be exported publicy.

BREAKING CHANGE:

The following are no longer publicly exported APIs. They were intended as internal
utilities and you should use your own util:

```
browserDetection,
dispatchEvent,
el,
normalizeCSS,
stringifyElement,
expect (and custom matchers for Jasmine)
```
2016-06-23 16:42:25 -07:00
Julie Ralph 894747c34c fix(platform-browser/testing-e2e): clean up unused exports from e2e testing helpers (#9387) 2016-06-23 16:14:31 -07:00
Julie Ralph 8d5a312585 chore(api): clean up compiler/testing api (#9520)
Do not export MockXHR, which is a private helper.
2016-06-23 15:52:18 -07:00
Jason Choi 22d8f73bc9 test: add public api golden files
Includes a few style fixes on "* as foo" imports.
2016-06-23 14:26:40 -07:00
Martin Probst 3ad81b1beb test(security): simplify integration test. 2016-06-23 13:57:51 -07:00
Martin Probst 5ab0534164 test(security): Ensure xlink:href is not bindable.
The DOM schema does not allow binding any properties to dangerous SVG
attributes/properties. This change adds a smoke test to verify that
behaviour, by testing that `xlink:href` (a sample dangerous property)
is not bindable.

Fixes #9510.
2016-06-23 13:57:51 -07:00
Igor Minar 5150344213 fix(common): add license header to localization.ts 2016-06-23 13:27:43 -07:00
Wojciech Kwiatek 98cef76931 fix(security): no warning when sanitizing escaped html (#9392) (#9413) 2016-06-23 13:06:19 -07:00
Tobias Bosch 6c5b653593 feat(core): add `@Component.precompile` and `ComponentFactoryResolver`
Part to #9467
Closes #9543
2016-06-23 12:10:04 -07:00
Tobias Bosch 9ed8f2d26e fix(compiler): don't inject `viewProviders` into content child elements
E.g. in the following scenario,
`some-directive` should not be able to inject
any view provider that `my-comp-with-view-providers`
declares.

```
<my-comp-with-view-providers>
  <div some-directive></div>
</my-comp-with-view-providers>
```
2016-06-23 12:10:04 -07:00