Allow more elements and attributes from the HTML5 spec which were stripped by the htmlSanitizer.
fixes#9438
feat(security): allow audio data URLs in urlSanitizer
test(security) : add test for valid audio data URL
feat(security): allow and sanitize srcset attributes
test(security): test for srcset sanitization
After splitting the facades into multiple modules,
enabling prod mode for code had no effect for the compiler.
Also in a change between RC1 and RC2 we created the `CompilerConfig`
via a provider with `useValue` and not via a `useFactory`, which reads
the prod mode too early.
Closes#9318Closes#8508Closes#9318
If a user ends up with a safe value in an interpolation context, that's probably
a bug. Returning `"SafeValue must use [property]= binding"` will make it easier
to detect and correct the situation. Detecting the situation and throwing an
error for it could cause performance issues, so we're not doing this at this
point (but might revisit later).
Part of #8511 and #9253.
"render" is gramatically incorrect and confusing to developers who used this api.
Since webworker apis were exposed only in master, renaming these before the rc2 release
is not a breaking change
Previously these symbols were exposed via platform-browser-dynamic, then we merged then into platform-browser
thinking that tools would know how to shake off the compiler and other dynamic bits not used with the offline
compilation flow. This turned out to be wrong as both webpack and rollup don't have good enough tree-shaking
capabilities to do this today. We think that in the future we'll be able to merge these two entry points into
one, but we need to give tooling some time before we can do it. In the meantime the reintroduction of the -dynamic
package point allows us to separate the compiler dependencies from the rest of the framework.
This change undoes the previous breaking change that removed the platform-browser-dynamic package.
This aligns the configuration of platform pipes / directives with offline compilation.
BREAKING CHANGE:
- `PLATFORM_PIPES` and `PLATFORM_DIRECTIVES` now are fields on `CompilerConfig`.
Instead of providing a binding to these tokens, provide a binding for `CompilerConfig` instead.
The web animations API now requires that all styles are converted to
camel case. Chrome has already made this breaking change and hyphenated
styles are not functional anymore.
Closes#9111Closes#9112
There is no need to expose this additional method inside of the Renderer
API. The functionality can be restored by looping and calling
`setElementStyle` instead.
Note that this change is changing code that was was introduced after
the last release therefore this fix is not a breaking change.
Closes#9000Closes#9009
Automatically recognize XSRF protection cookies, and set a corresponding XSRF
header. Allows applications to configure the cookie names, or if needed,
completely override the XSRF request configuration by binding their own
XSRFHandler implementation.
Part of #8511.
The code does not force the user to provider `RenderDebugInfo`. The
current implementation lists this as a mandatory parameter. Update
the parameter to be optional.
Fixes#8466Closes#8859
allows for
```
bootstrap(App, [
...HTTP_PROVIDERS,
...ROUTER_PROVIDERS
])
.then(enableDebugTools)
```
without breaking the rule of always returning a value in a promise
Allows sanitized URLs for CSS properties. These can be abused for information
leakage, but only if the CSS rules are already set up to allow for it. That is,
an attacker cannot cause information leakage without controlling the style rules
present, or a very particular setup.
Fixes#8514.
Cyrille Tuzi
Gion Kunz
Wojciech Kwiatek
Matias Niemelä
ScottSWu
Tobias Bosch
Martin Probst
Igor Minar
Kara
Alex Eagle
ScottSWu
Victor Berchet
Matt Wheatley
Vanga Sasidhar
Misko Hevery
Alfonso Presa
gdi2290
Brendan Wyse
Vamsi V
Andrew