908a102a87
Summary: This adds basic security hooks to Angular 2. * `SecurityContext` is a private API between core, compiler, and platform-browser. `SecurityContext` communicates what context a value is used in across template parser, compiler, and sanitization at runtime. * `SanitizationService` is the bare bones interface to sanitize values for a particular context. * `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)` determines the security context for an attribute or property (it turns out attributes and properties match for the purposes of sanitization). Based on these hooks: * `DomSchemaElementRegistry` decides what sanitization applies in a particular context. * `DomSanitizationService` implements `SanitizationService` and adds *Safe Value*s, i.e. the ability to mark a value as safe and not requiring further sanitization. * `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively (surprise!). `DomSanitizationService` is the default implementation bound for browser applications, in the three contexts (browser rendering, web worker rendering, server side rendering). BREAKING CHANGES: *** SECURITY WARNING *** Angular 2 Release Candidates do not implement proper contextual escaping yet. Make sure to correctly escape all values that go into the DOM. *** SECURITY WARNING *** Reviewers: IgorMinar Differential Revision: https://reviews.angular.io/D103
24 lines
682 B
TypeScript
24 lines
682 B
TypeScript
/**
|
|
* A SecurityContext marks a location that has dangerous security implications, e.g. a DOM property
|
|
* like `innerHTML` that could cause Cross Site Scripting (XSS) security bugs when improperly
|
|
* handled.
|
|
*
|
|
* See DomSanitizationService for more details on security in Angular applications.
|
|
*/
|
|
export enum SecurityContext {
|
|
NONE,
|
|
HTML,
|
|
STYLE,
|
|
SCRIPT,
|
|
URL,
|
|
RESOURCE_URL,
|
|
}
|
|
|
|
/**
|
|
* SanitizationService is used by the views to sanitize potentially dangerous values. This is a
|
|
* private API, use code should only refer to DomSanitizationService.
|
|
*/
|
|
export abstract class SanitizationService {
|
|
abstract sanitize(context: SecurityContext, value: string): string;
|
|
}
|