This addresses several oversights in assigning security contexts to DOM schema
elements found by our security reviewers (thanks!).
This also adds some more precise unit tests for the interaction between
(Dom)ElementSchemaRegistry and the TemplateParser, and extracts the security
specific parts into dom_security_schema.ts.
Comparison of (potentially) dangerous property names is done case insensitive,
to avoid issues like formAction vs formaction.
Part of issue #8511.
* fix(compiler): throw an error if variable with the same name is already defined. Closes#6492
* fix(compiler): Clean up formatting for issue #6492
* fix(compiler): throw an error if reference with the same name is already defined.
Closes#6492
<!-- xxxx ------->
The issue came from a lack of support for backtracking on string
matching.
The way it is done, if the "end pattern" for consumeRawText starts with
twice the same character, you end up having problem when your string
being parsed has 3 times this char
Example
End string: xxyz
string to parse: aaaaaaxxxyz
calling consumeRawText(false, 'x', attemptParseStr('xyz')) would fail
Closes#7119
Summary:
This adds basic security hooks to Angular 2.
* `SecurityContext` is a private API between core, compiler, and
platform-browser. `SecurityContext` communicates what context a value is used
in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
determines the security context for an attribute or property (it turns out
attributes and properties match for the purposes of sanitization).
Based on these hooks:
* `DomSchemaElementRegistry` decides what sanitization applies in a particular
context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
Value*s, i.e. the ability to mark a value as safe and not requiring further
sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
(surprise!).
`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).
BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***
Reviewers: IgorMinar
Differential Revision: https://reviews.angular.io/D103
Victor Berchet
Alex Eagle
Pawel Kozlowski
ScottSWu
Tobias Bosch
Matias Niemelä
Martin Probst
laco0416
Suguru Inatomi
Andrii Nechytailov
Igor Minar
Wesley Cho
Grégory Bataille
Tero Parviainen
Ward Bell
Vamsi Varikuti
alexcastillo
Igor Minar
Marc Laval
Vikram Subramanian
Misko Hevery