iSharkFly-Docs
/
angular-docs-cn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

refactor(compiler): remove unnecessary trustConstantScript function (#39554) 

Script tags, inline event handlers and other script contexts are
forbidden or stripped from Angular templates by the compiler. In the
context of Trusted Types, this leaves no sinks that require use of a
TrustedScript. This means that trustConstantScript is never used, and
can be removed.

PR Close #39554
This commit is contained in:
Bjarki 2020-11-18 17:02:41 +00:00 committed by Andrew Kushnir
parent 4916870dff
commit 2ae3fa009e
5 changed files with 2 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
packages/compiler/src/render3/r3_identifiers.ts
View File

@ -321,8 +321,6 @@ export class Identifiers {
static sanitizeUrlOrResourceUrl: static sanitizeUrlOrResourceUrl:
o.ExternalReference = {name: 'ɵɵsanitizeUrlOrResourceUrl', moduleName: CORE}; o.ExternalReference = {name: 'ɵɵsanitizeUrlOrResourceUrl', moduleName: CORE};
static trustConstantHtml: o.ExternalReference = {name: 'ɵɵtrustConstantHtml', moduleName: CORE}; static trustConstantHtml: o.ExternalReference = {name: 'ɵɵtrustConstantHtml', moduleName: CORE};
static trustConstantScript:
o.ExternalReference = {name: 'ɵɵtrustConstantScript', moduleName: CORE};
static trustConstantResourceUrl: static trustConstantResourceUrl:
o.ExternalReference = {name: 'ɵɵtrustConstantResourceUrl', moduleName: CORE}; o.ExternalReference = {name: 'ɵɵtrustConstantResourceUrl', moduleName: CORE};
} }

3
packages/compiler/src/render3/view/template.ts
View File

@ -2156,8 +2156,7 @@ function trustedConstAttribute(tagName: string, attr: t.TextAttribute): o.Expres
switch (elementRegistry.securityContext(tagName, attr.name, /* isAttribute */ true)) { switch (elementRegistry.securityContext(tagName, attr.name, /* isAttribute */ true)) {
case core.SecurityContext.HTML: case core.SecurityContext.HTML:
return o.importExpr(R3.trustConstantHtml).callFn([value], attr.valueSpan); return o.importExpr(R3.trustConstantHtml).callFn([value], attr.valueSpan);
case core.SecurityContext.SCRIPT: // NB: no SecurityContext.SCRIPT here, as the corresponding tags are stripped by the compiler.
return o.importExpr(R3.trustConstantScript).callFn([value], attr.valueSpan);
case core.SecurityContext.RESOURCE_URL: case core.SecurityContext.RESOURCE_URL:
return o.importExpr(R3.trustConstantResourceUrl).callFn([value], attr.valueSpan); return o.importExpr(R3.trustConstantResourceUrl).callFn([value], attr.valueSpan);
default: default:

1
packages/core/src/core_render3_private_export.ts
View File

@ -296,7 +296,6 @@ export {
ɵɵsanitizeUrlOrResourceUrl, ɵɵsanitizeUrlOrResourceUrl,
ɵɵtrustConstantHtml, ɵɵtrustConstantHtml,
ɵɵtrustConstantResourceUrl, ɵɵtrustConstantResourceUrl,
ɵɵtrustConstantScript,
} from './sanitization/sanitization'; } from './sanitization/sanitization';
export { export {
noSideEffects as ɵnoSideEffects, noSideEffects as ɵnoSideEffects,

1
packages/core/src/render3/jit/environment.ts
View File

@ -168,7 +168,6 @@ export const angularCoreEnv: {[name: string]: Function} =
'ɵɵsanitizeUrl': sanitization.ɵɵsanitizeUrl, 'ɵɵsanitizeUrl': sanitization.ɵɵsanitizeUrl,
'ɵɵsanitizeUrlOrResourceUrl': sanitization.ɵɵsanitizeUrlOrResourceUrl, 'ɵɵsanitizeUrlOrResourceUrl': sanitization.ɵɵsanitizeUrlOrResourceUrl,
'ɵɵtrustConstantHtml': sanitization.ɵɵtrustConstantHtml, 'ɵɵtrustConstantHtml': sanitization.ɵɵtrustConstantHtml,
'ɵɵtrustConstantScript': sanitization.ɵɵtrustConstantScript,
'ɵɵtrustConstantResourceUrl': sanitization.ɵɵtrustConstantResourceUrl, 'ɵɵtrustConstantResourceUrl': sanitization.ɵɵtrustConstantResourceUrl,
'ɵɵngDeclareDirective': partial.ɵɵngDeclareDirective, 'ɵɵngDeclareDirective': partial.ɵɵngDeclareDirective,

17
packages/core/src/sanitization/sanitization.ts
View File

@ -11,7 +11,7 @@ import {SANITIZER} from '../render3/interfaces/view';
import {getLView} from '../render3/state'; import {getLView} from '../render3/state';
import {renderStringify} from '../render3/util/stringify_utils'; import {renderStringify} from '../render3/util/stringify_utils';
import {TrustedHTML, TrustedScript, TrustedScriptURL} from '../util/security/trusted_type_defs'; import {TrustedHTML, TrustedScript, TrustedScriptURL} from '../util/security/trusted_type_defs';
import {trustedHTMLFromString, trustedScriptFromString, trustedScriptURLFromString} from '../util/security/trusted_types'; import {trustedHTMLFromString, trustedScriptURLFromString} from '../util/security/trusted_types';
import {trustedHTMLFromStringBypass, trustedScriptFromStringBypass, trustedScriptURLFromStringBypass} from '../util/security/trusted_types_bypass'; import {trustedHTMLFromStringBypass, trustedScriptFromStringBypass, trustedScriptURLFromStringBypass} from '../util/security/trusted_types_bypass';
import {allowSanitizationBypassAndThrow, BypassType, unwrapSafeValue} from './bypass'; import {allowSanitizationBypassAndThrow, BypassType, unwrapSafeValue} from './bypass';
@ -159,21 +159,6 @@ export function ɵɵtrustConstantHtml(html: string): TrustedHTML|string {
return trustedHTMLFromString(html); return trustedHTMLFromString(html);
} }
/**
* Promotes the given constant string to a TrustedScript.
* @param script constant string containing a trusted script.
* @returns TrustedScript wrapping `script`.
*
* @security This is a security-sensitive function and should only be used to
* convert constant values of attributes and properties found in
* application-provided Angular templates to TrustedScript.
*
* @codeGenApi
*/
export function ɵɵtrustConstantScript(script: string): TrustedScript|string {
return trustedScriptFromString(script);
}
/** /**
* Promotes the given constant string to a TrustedScriptURL. * Promotes the given constant string to a TrustedScriptURL.
* @param url constant string containing a trusted script URL. * @param url constant string containing a trusted script URL.