Commit Graph

228 Commits

Author SHA1 Message Date
Victor Berchet 40f8a45b95 test(DatePipe): fixes 2016-06-17 15:48:26 -07:00
Victor Berchet 76a418760e fix(BrowserUtil): fix `supportsIntlApi()` 2016-06-17 15:34:12 -07:00
Martin Probst 8879aa1df4 feat(security): fail more detectably when using a safe value in an interpolation.
If a user ends up with a safe value in an interpolation context, that's probably
a bug. Returning `"SafeValue must use [property]= binding"` will make it easier
to detect and correct the situation. Detecting the situation and throwing an
error for it could cause performance issues, so we're not doing this at this
point (but might revisit later).

Part of #8511 and #9253.
2016-06-17 10:00:30 -07:00
Alex Eagle 37b617dccf chore(tsickle): add @Annotation annotations
This lets users continue using runtime-sideeffect Decorators if they choose,
only down-leveling the marked ones to Annotations.

Also remove the "skipTemplateCodegen" option, which is no longer needed
since Angular compiles with tsc-wrapped rather than ngc. The former doesn't
include any codegen.
2016-06-16 12:29:46 -07:00
Igor Minar 26676c4833 docs(webworker): add/correct experimental markers to web worker apis 2016-06-15 17:12:40 -07:00
Igor Minar 933f45ef31 docs(webworkers): add experimental markers for all web worker public apis 2016-06-15 09:38:03 -07:00
Igor Minar 4fc37aeabd fix(webworkers): rename all web worker apis with "render" to "ui"
"render" is gramatically incorrect and confusing to developers who used this api.

Since webworker apis were exposed only in master, renaming these before the rc2 release
is not a breaking change
2016-06-15 09:38:03 -07:00
Kara 22916bb5d1 feat(forms): add easy way to switch between forms modules (#9202) 2016-06-14 18:23:40 -07:00
Igor Minar 6fc267f22c fix: split dynamic bits in platform-browser into platform-browser-dynamic
Previously these symbols were exposed via platform-browser-dynamic, then we merged then into platform-browser
thinking that tools would know how to shake off the compiler and other dynamic bits not used with the offline
compilation flow. This turned out to be wrong as both webpack and rollup don't have good enough tree-shaking
capabilities to do this today. We think that in the future we'll be able to merge these two entry points into
one, but we need to give tooling some time before we can do it. In the meantime the reintroduction of the -dynamic
package point allows us to separate the compiler dependencies from the rest of the framework.

This change undoes the previous breaking change that removed the platform-browser-dynamic package.
2016-06-14 15:31:24 -07:00
Tobias Bosch bc888bf3a1 refactor(compiler): Change arguments of `CompilerConfig` to named arguments
BREAKIKNG CHANGE:
`CompilerConfig` used to take positional arguments and now takes named arguments.

Closes #9172
2016-06-13 13:14:07 -07:00
Tobias Bosch 1745366530 refactor(compiler): make `PLATFORM_PIPES` / `PLATFORM_DIRECTIVES` an option on `CompilerConfig`
This aligns the configuration of platform pipes / directives with offline compilation.

BREAKING CHANGE:
- `PLATFORM_PIPES` and `PLATFORM_DIRECTIVES` now are fields on `CompilerConfig`. 
  Instead of providing a binding to these tokens, provide a binding for `CompilerConfig` instead.
2016-06-13 13:13:45 -07:00
ScottSWu 14a3ade662 chore(typescript): Changed double asterisks in #9100 to single asterisks
As in #9151, these comments are being read as JSDoc comments. This commit is smaller and only touches a few files that are causing errors.
2016-06-13 10:53:31 -07:00
Matias Niemelä 55860e1621 fix(animations): ensure AUTO styles are cleared at the end of the state-change animation
Closes #9014
Closes #9015
2016-06-11 00:08:41 -07:00
Matias Niemelä 4d51158b1a fix(animations): ensure the web-animations driver converts style props to camel-case
The web animations API now requires that all styles are converted to
camel case. Chrome has already made this breaking change and hyphenated
styles are not functional anymore.

Closes #9111
Closes #9112
2016-06-10 22:54:10 -07:00
Alex Eagle f39c9c9e75 style(lint): re-format modules/@angular 2016-06-09 17:00:15 -07:00
Victor Berchet 7ce0fc7d47 refactor: add types (#9116) 2016-06-09 11:04:15 -07:00
Martin Probst 346304762e feat(security): document <iframe src> to be TRUSTED_URL.
Docs on the DomSanitizationService didn't match actual usage before.

Also fixes some minor docs and implementation issues.
2016-06-08 20:49:15 -07:00
ScottSWu 86fbd50c3d refactor(TypeScript): Add noImplicitAny
We automatically insert explicit 'any's where needed. These need to be
addressed as in #9100.

Fixes #4924
2016-06-08 16:20:50 -07:00
Matias Niemelä e504d4eb05 fix(renderer): remove unecessary setElementStyles method
There is no need to expose this additional method inside of the Renderer
API. The functionality can be restored by looping and calling
`setElementStyle` instead.

Note that this change is changing code that was was introduced after
the last release therefore this fix is not a breaking change.

Closes #9000
Closes #9009
2016-06-03 15:20:34 -07:00
Victor Berchet a6ad61d83e refactor: change provide(...) for {provide: ...}
- provide() is deprecated,
- {} syntax is required by the offline compiler
2016-06-03 15:03:49 -07:00
Victor Berchet 27a47e7841 refactor(imports): simplify paths 2016-06-03 14:46:04 -07:00
Matias Niemelä fa0718ba9a feat(animations): provide support for offline compilation 2016-06-03 14:36:11 -07:00
Igor Minar dd6cb233b5 build: add missing testing.ts entry points to tsconfigs 2016-06-01 10:43:22 -07:00
Victor Berchet f2809d1ed8 fix(PostMessageBus):Add the worker scope to please Closure 2016-06-01 09:24:05 -07:00
Vikram Subramanian f4f6b8721a fix(core): Keep core exports seperate from core/testing exports. 2016-05-31 20:09:43 -07:00
Martin Probst 4d793c4eb8 feat(security): Automatic XSRF handling.
Automatically recognize XSRF protection cookies, and set a corresponding XSRF
header. Allows applications to configure the cookie names, or if needed,
completely override the XSRF request configuration by binding their own
XSRFHandler implementation.

Part of #8511.
2016-05-31 16:12:33 -07:00
Alex Eagle c6064a30a1 chore(package.json): make the packages installable 2016-05-27 17:21:34 -07:00
Alex Eagle 2019050db2 chore(lint): enable duplicateModuleImport tslint check 2016-05-27 09:17:08 -07:00
Matt Wheatley b7b56785d1 fix(Renderer): update signatures to make RenderDebugInfo optional
The code does not force the user to provider `RenderDebugInfo`. The
current implementation lists this as a mandatory parameter. Update
the parameter to be optional.

Fixes #8466

Closes #8859
2016-05-26 10:32:03 -07:00
Victor Berchet 172a5663ef feat(platform-browser-dynamic): re-add a deprecated platform-browser-dynamic 2016-05-26 10:22:39 -07:00
Victor Berchet f4b972815b fix(platform-browser): fix rollup config 2016-05-26 10:21:24 -07:00
Vanga Sasidhar bab6023eee fix(router): Added pushState fallback for IE 9 browser.
Closes #6506

Closes #7929
2016-05-26 09:49:07 -07:00
Martin Probst 5e12a95789 test(security): test case for quoted URL values.
Test case that fixes #8701. This is already supported with the latest sanitizer
changes, but it's good to have an explicit test case.
2016-05-26 09:39:23 -07:00
Igor Minar b9347eb01c build: remove dependency on tsd and use @types/* instead 2016-05-25 16:42:28 -07:00
Igor Minar 4dbd8ed6b8 refactor: remove unnecessary annotations 2016-05-25 16:42:28 -07:00
Misko Hevery cb980d3e43 fix(ci): incorrect import 2016-05-25 16:22:55 -07:00
Misko Hevery d0a64f9c86 fix: broken build 2016-05-25 16:03:11 -07:00
Miško Hevery 39ecd01b86 chore: audit @angular/core API classification (#8808) 2016-05-25 15:00:05 -07:00
Matias Niemelä 5e0f8cf3f0 feat(core): introduce support for animations
Closes #8734
2016-05-25 13:56:50 -07:00
Igor Minar 16dfe3c63f build: consolidate tsc to ease migration to @types/ based typings delivery
I actually tried to use @types/* directly but came across several issues which prevented me
from switching over:
- https://github.com/Microsoft/TypeScript/issues/8715
- https://github.com/Microsoft/TypeScript/issues/8723
2016-05-25 08:22:07 -07:00
Alfonso Presa 5f3d02bc7c fix(Animation): Problem decimals using commas as decimal separation
Tests where failing due to `.` character being used as decimal separator in some regional settings (like spanish for example)

Closes #6335

Closes #6338
2016-05-24 21:23:46 -07:00
gdi2290 d4827caa08 refactor(DomRootRenderer): allow registeredComponents access
Closes #6584
2016-05-24 21:17:11 -07:00
Matias Niemelä 1ac38bd69a feat(renderer): add a `setElementStyles` method 2016-05-24 18:42:05 -07:00
Thierry Templier 0f0a8ade7c feat(http): automatically set request Content-Type header based on body type
Implement the ability to provide objects as request body. The following use cases
are supported:
* raw objects: a JSON payload is created and the content type set to `application/json`
* text: the text is used as it is and no content type header is automatically added
* URLSearchParams: a form payload is created and the content type set to `application/x-www-form-urlencoded`
* FormData: the object is used as it is and no content type header is automatically added
* Blob: the object is used as it is and the content type set with the value of its `type` property if any
* ArrayBuffer: the object is used as it is and no content type header is automatically added

Closes https://github.com/angular/http/issues/69

Closes #7310
2016-05-24 11:42:37 -07:00
Victor Berchet 75e6dfb9ab fix(browser): platform code cleanup 2016-05-23 17:57:28 -07:00
Victor Berchet f95a604b59 fix(bootstrap): swap coreBootstrap() and coreLoadAndBootstrap() arguments 2016-05-23 17:57:28 -07:00
Brendan Wyse fba0e2ff12 docs(browser.ts): update bootstrap injector override argument name
Closes #7387
2016-05-23 17:21:07 -07:00
Vamsi V b62415c962 refactor(chore): remove unused mapToObject and objectToMap methods from serializer
resolves #7402

Closes #7416
2016-05-23 17:20:25 -07:00
Vamsi Varikuti 0795dd307b refactor(chore): Replace all 'bindings' with 'providers'
BREAKING CHANGE

Deprecated `bindings:` and `viewBindings:` are replaced with
`providers:` and `viewProviders:`

Closes #7687
2016-05-23 13:31:08 -07:00
Andrew 33c7f74cb9 style(platform/browser): fix type spacing
Closes #7980
2016-05-20 13:05:40 -07:00
Igor Minar 0035575c82 build: turn on tsc's stripInternal when producint public d.ts file
I also made some changes to fix imports and remove some stuff that caused
breakage once stripInternals was turned on.
2016-05-20 10:59:57 -07:00
Victor Berchet e8e61de28d refactor(WebWorker): move XHR worker side 2016-05-20 10:48:55 -07:00
Victor Berchet 54f8308999 refactor(browser): merge static & dynamic platforms 2016-05-20 10:48:55 -07:00
PatrickJS 6c99746f0b Update tools.ts
Closes #8296
2016-05-20 10:12:54 -07:00
PatrickJS 4086b49046 feat(enableDebugTools): return ComponentRef
allows for 
```
bootstrap(App, [
  ...HTTP_PROVIDERS,
  ...ROUTER_PROVIDERS
])
.then(enableDebugTools)
```
without breaking the rule of always returning a value in a promise
2016-05-20 10:12:54 -07:00
Victor Berchet 6e62217b78 fix(WebWorker): remove the platform-browser dependency on compiler 2016-05-18 16:23:09 -07:00
Joost de Vries a01a54c180 adds 'repository' metadata to npm modules (#8649) 2016-05-17 23:17:15 -07:00
Martin Probst 15ae710d22 feat(security): allow url(...) style values.
Allows sanitized URLs for CSS properties. These can be abused for information
leakage, but only if the CSS rules are already set up to allow for it. That is,
an attacker cannot cause information leakage without controlling the style rules
present, or a very particular setup.

Fixes #8514.
2016-05-17 11:23:31 +02:00
Martin Probst dd50124254 feat(security): allow data: URLs for images and videos.
Allows known-to-be-safe media types in data URIs.

Part of #8511.
2016-05-17 10:57:14 +02:00
Martin Probst 50c9bed630 feat(security): expose the safe value types.
This allows users to properly type their `SafeHtml`, `SafeStyle`, etc values.

Fixes #8568.
2016-05-15 11:47:06 +02:00
Martin Probst 8b1b427195 feat(security): support transform CSS functions for sanitization.
Fixes part of #8514.
2016-05-14 13:25:45 +02:00
Marc Laval 61b339678d test(compiler): test schema generation only in Chrome
Closes #8581
2016-05-11 17:01:26 -07:00
Martin Probst 3e68b7eb1f feat(security): warn users when sanitizing in dev mode.
This should help developers to figure out what's going on when the sanitizer
strips some input.

Fixes #8522.
2016-05-09 16:46:31 +02:00
Matias Niemelä 9fbafba993 chore(parsing): change internal usage of `@` to `:` for namespaced values
Closes #8346
2016-05-09 16:20:32 +02:00
Martin Probst 7a524e3deb feat(security): add tests for URL sanitization. 2016-05-09 16:00:24 +02:00
Martin Probst 7b6c4d5acc feat(security): add tests for style sanitisation. 2016-05-09 16:00:24 +02:00
Martin Probst f86edae9f3 feat(security): add an HTML sanitizer.
This is based on Angular 1's implementation, parsing an HTML document
into an inert DOM Document implementation, and then serializing only
specifically whitelisted elements.

It currently does not support SVG sanitization, all SVG elements are
rejected.

If available, the sanitizer uses the `<template>` HTML element as an
inert container.

Sanitization works client and server-side.

Reviewers: rjamet, tbosch , molnarg , koto

Differential Revision: https://reviews.angular.io/D108
2016-05-09 16:00:24 +02:00
Igor Minar 905f38acb8 build: fix source map paths for npm packages
the bundles have source mpas disabled for now because when we downlevel
the esm bundle to es5 tsc doesn't consider the original source map so
we end up with a source map pointing to the esm bundle instead which is
not useful.
2016-05-03 13:36:33 -06:00
Martin Probst 908a102a87 feat: security implementation in Angular 2.
Summary:
This adds basic security hooks to Angular 2.

* `SecurityContext` is a private API between core, compiler, and
  platform-browser. `SecurityContext` communicates what context a value is used
  in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
  particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
  determines the security context for an attribute or property (it turns out
  attributes and properties match for the purposes of sanitization).

Based on these hooks:

* `DomSchemaElementRegistry` decides what sanitization applies in a particular
  context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
  Value*s, i.e. the ability to mark a value as safe and not requiring further
  sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
  (surprise!).

`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).

BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***

Reviewers: IgorMinar

Differential Revision: https://reviews.angular.io/D103
2016-05-03 09:21:43 -07:00
Tobias Bosch 43527172ed chore: don’t shadow `tsconfig.json` used for editors by build specific tsconfig.json 2016-05-02 15:06:46 -07:00
Misko Hevery 107016ec12 chore: router move import changes 2016-05-02 13:27:03 -07:00
Alex Eagle 3ae856ab8b build(tsc): Use angular2-template-compiler in place of tsc
This lets us down-level Decorators with tsickle and produce .metadata.json
files for users to reference when offline-compiling their app.
2016-05-01 23:40:59 -07:00
Misko Hevery 3e17c99f4e chore: clang-reformat 2016-05-01 22:59:41 -07:00
Misko Hevery cd52318f48 fix: parse browser detection lazily 2016-05-01 22:27:55 -07:00
Alex Eagle c4be30d2e8 Revert "build(tsc): Use angular2-template-compiler in place of tsc"
This reverts commit 3d25294f706e0fd6224b20372be1e961959c0af8.
2016-05-01 20:51:00 -07:00
Alex Eagle 57240c85a5 build(tsc): Use angular2-template-compiler in place of tsc
This gives us tsickle pre-processing of Decorators, and produces
.metadata.json files for users to consume in their offline compilation.
2016-05-01 20:51:00 -07:00
Igor Minar a66cdb469f repackaging: all the repackaging changes squashed 2016-05-01 20:51:00 -07:00
Igor Minar 505da6c0a8 repackaging: all the file moves 2016-05-01 20:51:00 -07:00