The code does not force the user to provider `RenderDebugInfo`. The
current implementation lists this as a mandatory parameter. Update
the parameter to be optional.
Fixes#8466Closes#8859
The current behavior is for ngDoCheck to supplement, not override, the default change detector. OnChanges will still be called when DoCheck is implemented (fixes#7307).
Clicks on router-link should not prevent browser default action when
any mouse button other than left mouse button or ctrl/meta key is pressed.
router-link href should use location strategy external url.
Closes#5908Closes#6806Closes#7749Closes#8806Closes#8821
This allows angular's build to depend on some extensions, but not on code generation, and breaks a cycle in the angular build
We now merge ts-metadata-collector into tsc-wrapped and stop publishing the former.
This symbol is no longer reexported at the top level, so it's safe to not mark it as internal.
This fixes the offline compilation which got broken by this symbol not being present in the d.ts
files when the compiler tries to do a deep import.
Closes#8819
<!-- xxxx ------->
The issue came from a lack of support for backtracking on string
matching.
The way it is done, if the "end pattern" for consumeRawText starts with
twice the same character, you end up having problem when your string
being parsed has 3 times this char
Example
End string: xxyz
string to parse: aaaaaaxxxyz
calling consumeRawText(false, 'x', attemptParseStr('xyz')) would fail
Closes#7119
Taken into account the withCredentials property within the request options:
- added corresponding property in the RequestOptions class
- added corresponding property in the Request class
- handle this property when merging options
- set the withCredentials property on the XHR object when specified
Added a test in the xhr_backend_spec.ts to check that the property is actually
set on the XHR object
Closes https://github.com/angular/http/issues/65Closes#7281Closes#7281
Implement the ability to provide objects as request body. The following use cases
are supported:
* raw objects: a JSON payload is created and the content type set to `application/json`
* text: the text is used as it is and no content type header is automatically added
* URLSearchParams: a form payload is created and the content type set to `application/x-www-form-urlencoded`
* FormData: the object is used as it is and no content type header is automatically added
* Blob: the object is used as it is and the content type set with the value of its `type` property if any
* ArrayBuffer: the object is used as it is and no content type header is automatically added
Closes https://github.com/angular/http/issues/69Closes#7310
The strategies for Promise and Observable based subscriptions
have (nearly) the same method signatures. They should implement
a common interface.
Closes#7573
By adding `regex_named_groups` to regex route configurations we can consistently map
regex matching groups to component parameters.
This should fix#7554.
Closes#7694
Make sure the same path is not added multiple times to the history.
It is replacing the state, instead of skipping it completely,
because the current path in the browser might not be normalized,
while the given one is normalized.
Closes#7829Closes#7897
allows for
```
bootstrap(App, [
...HTTP_PROVIDERS,
...ROUTER_PROVIDERS
])
.then(enableDebugTools)
```
without breaking the rule of always returning a value in a promise
Currently downgraded ng2 elements fail inside a ui-router view because they are unable
to require an ng2 Injector via the require attribute of the DDO, because ui-router compiles
its templates before they are inserted in a ui-view. This adds a "fallback" behavior if
a parent injector cannot be found to go to the root ng2 Injector.
Delays NG1 Directive controller instatiation where possible and pre-link function always
to the ngOnInit() lifecycle hook. This way bindings are always available on $scope in both
the controller and the link function.
Allows sanitized URLs for CSS properties. These can be abused for information
leakage, but only if the CSS rules are already set up to allow for it. That is,
an attacker cannot cause information leakage without controlling the style rules
present, or a very particular setup.
Fixes#8514.
This is based on Angular 1's implementation, parsing an HTML document
into an inert DOM Document implementation, and then serializing only
specifically whitelisted elements.
It currently does not support SVG sanitization, all SVG elements are
rejected.
If available, the sanitizer uses the `<template>` HTML element as an
inert container.
Sanitization works client and server-side.
Reviewers: rjamet, tbosch , molnarg , koto
Differential Revision: https://reviews.angular.io/D108
When a view is destroyed, we destroy all
views in view containers and should not detach them. However, previously, we also detached them which lead to problems during the iteration loop.
Closes#8458Closes#8471
Introduced by 0c600cf6e3
the bundles have source mpas disabled for now because when we downlevel
the esm bundle to es5 tsc doesn't consider the original source map so
we end up with a source map pointing to the esm bundle instead which is
not useful.
Summary:
This adds basic security hooks to Angular 2.
* `SecurityContext` is a private API between core, compiler, and
platform-browser. `SecurityContext` communicates what context a value is used
in across template parser, compiler, and sanitization at runtime.
* `SanitizationService` is the bare bones interface to sanitize values for a
particular context.
* `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)`
determines the security context for an attribute or property (it turns out
attributes and properties match for the purposes of sanitization).
Based on these hooks:
* `DomSchemaElementRegistry` decides what sanitization applies in a particular
context.
* `DomSanitizationService` implements `SanitizationService` and adds *Safe
Value*s, i.e. the ability to mark a value as safe and not requiring further
sanitization.
* `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively
(surprise!).
`DomSanitizationService` is the default implementation bound for browser
applications, in the three contexts (browser rendering, web worker rendering,
server side rendering).
BREAKING CHANGES:
*** SECURITY WARNING ***
Angular 2 Release Candidates do not implement proper contextual escaping yet.
Make sure to correctly escape all values that go into the DOM.
*** SECURITY WARNING ***
Reviewers: IgorMinar
Differential Revision: https://reviews.angular.io/D103
Impure pipes need to live on the view
that used them and need a new instance for
each call site.
Impure pipes need to live on the component view, cached across all child views,
and need a new pure proxy for each for
each call site that lives on the view
of the call site.
Fixes#8408
This bug was introduced not long ago by 152a117d5c
Thierry Templier
Matt Wheatley
Zach Bjornson
Dimitrios Loukadakis
Victor Berchet
Julie Ralph
Suguru Inatomi
Igor Minar
Ajay Ambre
Jonathan Miles
Ivan Gabriele
Vanga Sasidhar
Martin Probst
Rob Wormald
Igor Minar
Misko Hevery
Alex Eagle
Matias Niemelä
Alex Eagle
Wesley Cho
Jay Phelps
Alfonso Presa
Utsav Shah
gdi2290
Gabe Scholz
Borys Semerenko
Grégory Bataille
cexbrayat
Wassim Chegham
Dmytro Kulyk
Kara Erickson
Andreas Wissel
Kevin-K
Brendan Wyse
Vamsi V
Tom Schoener
Tero Parviainen
Ward Bell
Pete Boere
Peter Bacon Darwin
Sebastian Hillig
Justin DuJardin
cjc343
laco0416
kurt
Pete Mertz
Rene Weber
Pascal Precht
mgechev
Andrew
alexcastillo
Elliott Davis
Tobias Bosch
Drew Moore
Jake Garelick
Yang Lin
agpreynolds
Aliaksei Palkanau
BeastCode
William Welling
Sekib Omazic
Kai Ruhnau
Joost de Vries
Hannah Howard
Vikram Subramanian
Marc Laval
vsavkin
Felix Itzenplitz