908a102a87
Summary: This adds basic security hooks to Angular 2. * `SecurityContext` is a private API between core, compiler, and platform-browser. `SecurityContext` communicates what context a value is used in across template parser, compiler, and sanitization at runtime. * `SanitizationService` is the bare bones interface to sanitize values for a particular context. * `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)` determines the security context for an attribute or property (it turns out attributes and properties match for the purposes of sanitization). Based on these hooks: * `DomSchemaElementRegistry` decides what sanitization applies in a particular context. * `DomSanitizationService` implements `SanitizationService` and adds *Safe Value*s, i.e. the ability to mark a value as safe and not requiring further sanitization. * `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively (surprise!). `DomSanitizationService` is the default implementation bound for browser applications, in the three contexts (browser rendering, web worker rendering, server side rendering). BREAKING CHANGES: *** SECURITY WARNING *** Angular 2 Release Candidates do not implement proper contextual escaping yet. Make sure to correctly escape all values that go into the DOM. *** SECURITY WARNING *** Reviewers: IgorMinar Differential Revision: https://reviews.angular.io/D103
15 lines
873 B
TypeScript
15 lines
873 B
TypeScript
import {__core_private__ as r, __core_private_types__ as t} from '@angular/core';
|
|
|
|
export type RenderDebugInfo = t.RenderDebugInfo;
|
|
export var RenderDebugInfo: typeof t.RenderDebugInfo = r.RenderDebugInfo;
|
|
export var wtfInit: typeof t.wtfInit = r.wtfInit;
|
|
export var ReflectionCapabilities: typeof t.ReflectionCapabilities = r.ReflectionCapabilities;
|
|
export var VIEW_ENCAPSULATION_VALUES: typeof t.VIEW_ENCAPSULATION_VALUES =
|
|
r.VIEW_ENCAPSULATION_VALUES;
|
|
export type DebugDomRootRenderer = t.DebugDomRootRenderer;
|
|
export var DebugDomRootRenderer: typeof t.DebugDomRootRenderer = r.DebugDomRootRenderer;
|
|
export var SecurityContext: typeof t.SecurityContext = r.SecurityContext;
|
|
export type SecurityContext = t.SecurityContext;
|
|
export var SanitizationService: typeof t.SanitizationService = r.SanitizationService;
|
|
export type SanitizationService = t.SanitizationService;
|