From 346304762e27ad62e3ed866ddf93f399d775568e Mon Sep 17 00:00:00 2001
From: Martin Probst <martin@probst.io>
Date: Thu, 2 Jun 2016 17:50:58 -0700
Subject: [PATCH] feat(security): document <iframe src> to be TRUSTED_URL.

Docs on the DomSanitizationService didn't match actual usage before.

Also fixes some minor docs and implementation issues.
---
 .../src/security/dom_sanitization_service.ts              | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/@angular/platform-browser/src/security/dom_sanitization_service.ts b/modules/@angular/platform-browser/src/security/dom_sanitization_service.ts
index cbe5adc997..8053b8efbb 100644
--- a/modules/@angular/platform-browser/src/security/dom_sanitization_service.ts
+++ b/modules/@angular/platform-browser/src/security/dom_sanitization_service.ts
@@ -81,7 +81,7 @@ export abstract class DomSanitizationService implements SanitizationService {
 
   /**
    * Bypass security and trust the given value to be a safe style URL, i.e. a value that can be used
-   * in hyperlinks or `<iframe src>`.
+   * in hyperlinks or `<img src>`.
    *
    * WARNING: calling this method with untrusted user data will cause severe security bugs!
    */
@@ -89,11 +89,11 @@ export abstract class DomSanitizationService implements SanitizationService {
 
   /**
    * Bypass security and trust the given value to be a safe resource URL, i.e. a location that may
-   * be used to load executable code from, like `<script src>`.
+   * be used to load executable code from, like `<script src>`, or `<iframe src>`.
    *
    * WARNING: calling this method with untrusted user data will cause severe security bugs!
    */
-  abstract bypassSecurityTrustResourceUrl(value: string): any /** TODO #9100 */;
+  abstract bypassSecurityTrustResourceUrl(value: string): SafeResourceUrl;
 }
 
 
@@ -133,7 +133,7 @@ export class DomSanitizationServiceImpl extends DomSanitizationService {
 
   private checkNotSafeValue(value: any, expectedType: string) {
     if (value instanceof SafeValueImpl) {
-      throw new Error('Required a safe ' + expectedType + ', got a ' + value.getTypeName());
+      throw new Error(`Required a safe ${expectedType}, got a ${value.getTypeName()}`);
     }
   }