Commit Graph

99 Commits

Author SHA1 Message Date
Martin Probst 810c722413 docs(security): point users to docs when sanitization fails. (#9680) 2016-06-28 18:13:46 -07:00
Naomi Black 9340e1b065 docs(security): security api doc update and fix stability marker for Type 2016-06-28 14:01:48 -07:00
Martin Probst 2d9d7f1310 fix(security): allow empty CSS values. (#9675) 2016-06-28 11:45:02 -07:00
Victor Berchet 5ee84fe0f6 refactor: add types (#9606)
relates to #9100
2016-06-28 11:35:59 -07:00
Igor Minar 24eb8389d2 fix: public api surface fixes + stability markers
- ts-api-guardian will now error if a new public symbol is added with a stability marker (`@stable`, `@experimental`, `@deprecated`)
- DomEventsPlugin and KeyEventsPlugin were removed from public api surface - these classes is an implementation detail
- deprecated BROWSER_PROVIDERS was removed completely
- `@angular/compiler` was removed from the ts-api-guardian check since this package shouldn't contain anything that users need to directly import
- the rest of the api surface was conservatively marked as stable or experimental

BREAKING CHANGES: DomEventsPlugin and KeyEventsPlugin previously exported from core are no longer public - these classes are implementation detail.

Previously deprecated BROWSER_PROVIDERS was completely removed from platform-browser.

Closes #9236
Closes #9235
Ref #9234
2016-06-28 07:39:40 -07:00
Martin Probst db66509e66 test(security): tests for HTML5 elements, srcset.
Part of #9572.
2016-06-27 12:19:03 -07:00
Cyrille Tuzi 6605eb30e9 feat(security): allow more HTML5 elements and attributes in sanitizers
Allow more elements and attributes from the HTML5 spec which were stripped by the htmlSanitizer.

fixes #9438

feat(security): allow audio data URLs in urlSanitizer

test(security) : add test for valid audio data URL

feat(security): allow and sanitize srcset attributes

test(security): test for srcset sanitization
2016-06-27 12:19:03 -07:00
Gion Kunz 3644eef860 feat(DomRenderer): Adding support for document fragments in SVG foreign objects (#9458) 2016-06-27 08:26:45 -07:00
Julie Ralph 40b907a657 refactor(testing): remove wrapping of Jasmine functions (#9564)
Instead, the async function now determines whether it should return a promise
or instead call a done function parameter. Importing Jasmine functions
from `@angular/core/testing` is no longer necessary and is now deprecated.

Additionally, beforeEachProviders is also deprecated, as it is specific
to the testing framework. Instead, use the new addProviders method directly.

Before:
```js
import {beforeEachProviders, it, describe, inject} from 'angular2/testing/core';

describe('my code', () => {
  beforeEachProviders(() => [MyService]);

  it('does stuff', inject([MyService], (service) => {
    // actual test
  });
});
```

After:
```js
import {addProviders, inject} from 'angular2/testing/core';

describe('my code', () => {
  beforeEach(() => {
    addProviders([MyService]);
  });

  it('does stuff', inject([MyService], (service) => {
    // actual test
  });
});
```
2016-06-24 17:48:35 -07:00
Julie Ralph dcf75126bf fix(common/testing): remove internal MockLocationStrategy from common/testing (#9562)
BREAKING CHANGE:

MockLocationStrategy was intended to be internal only and is now removed
from the `@angular/common/testing` public api.

Use `SpyLocation` from `@angular/common/testing` for location testing.
2016-06-24 12:41:57 -07:00
Julie Ralph 8a9e9c7bd3 fix(core/testing): clean up the core testing public API (#9466)
Previously, we were exporting internal mocks and helpers. Move these
to core/testing/testing_internal or remove them if they were
never used.

Remove deprecated items - injectAsync, clearPendingTimers.

BREAKING CHANGE:

Remove the following APIs from `@angular/core/testing`, which have been deprecated or were
never intended to be publicly exported:

```
injectAsync
clearPendingTimers
Log
MockAppliacationHref
MockNgZone
clearPendingTimers
getTypeOf
instantiateType
```

Instead of `injectAsync`, use `async(inject())`.

`clearPendingTimers` is no longer required.
2016-06-23 17:10:22 -07:00
Julie Ralph 3d8eb8cbca fix(platform-browser/testing): clean up public api for platform-browser/testing (#9519)
Mostly, removing things that were never intended to be exported publicy.

BREAKING CHANGE:

The following are no longer publicly exported APIs. They were intended as internal
utilities and you should use your own util:

```
browserDetection,
dispatchEvent,
el,
normalizeCSS,
stringifyElement,
expect (and custom matchers for Jasmine)
```
2016-06-23 16:42:25 -07:00
Julie Ralph 894747c34c fix(platform-browser/testing-e2e): clean up unused exports from e2e testing helpers (#9387) 2016-06-23 16:14:31 -07:00
Wojciech Kwiatek 98cef76931 fix(security): no warning when sanitizing escaped html (#9392) (#9413) 2016-06-23 13:06:19 -07:00
Matias Niemelä c43aec2182 fix(animations): make sure the easing value is passed into the web-animations player
Closes #9517
Closes #9523
2016-06-23 10:14:18 -07:00
ScottSWu ae75e3640a chore(lint): Added license headers to most TypeScript files
Relates to #9380
2016-06-23 09:47:54 -07:00
Victor Berchet e1e5c40ef7 fix(testing): remove the `toThrowErrorWith` matcher (jasmine has `toThrowError`)
BREAKING CHANGE:

Before:

    expect(...).toThrowErrorWith(msg);

After:

    expect(...).toThrowError(msg);
2016-06-23 08:58:52 -07:00
Victor Berchet 6420f75320 fix(testing): remove the `toMatchPattern` matcher (jasmine has `toMatch`)
BREAKING CHANGE:

Before:

    expect(...).toMatchPattern(pattern);

After:

    expect(...).toMatch(pattern);
2016-06-23 08:58:28 -07:00
PatrickJS 297f0fd2c3 fix(core/testing): show full error
test(platform-browser): update fail capture

test(platform-browser-dynamic): update fail capture
2016-06-20 19:36:37 -07:00
Matias Niemelä ba46ca683b fix(animations): ensure starting styles are applied when a delay is present
Closes #9326
Closes #9328
2016-06-20 11:16:39 -07:00
Tobias Bosch c0f2a22a08 fix(perf): support prod mode again
After splitting the facades into multiple modules,
enabling prod mode for code had no effect for the compiler.

Also in a change between RC1 and RC2 we created the `CompilerConfig`
via a provider with `useValue` and not via a `useFactory`, which reads
the prod mode too early.

Closes #9318
Closes #8508
Closes #9318
2016-06-17 15:59:27 -07:00
Victor Berchet 40f8a45b95 test(DatePipe): fixes 2016-06-17 15:48:26 -07:00
Victor Berchet 76a418760e fix(BrowserUtil): fix `supportsIntlApi()` 2016-06-17 15:34:12 -07:00
Martin Probst 8879aa1df4 feat(security): fail more detectably when using a safe value in an interpolation.
If a user ends up with a safe value in an interpolation context, that's probably
a bug. Returning `"SafeValue must use [property]= binding"` will make it easier
to detect and correct the situation. Detecting the situation and throwing an
error for it could cause performance issues, so we're not doing this at this
point (but might revisit later).

Part of #8511 and #9253.
2016-06-17 10:00:30 -07:00
Alex Eagle 37b617dccf chore(tsickle): add @Annotation annotations
This lets users continue using runtime-sideeffect Decorators if they choose,
only down-leveling the marked ones to Annotations.

Also remove the "skipTemplateCodegen" option, which is no longer needed
since Angular compiles with tsc-wrapped rather than ngc. The former doesn't
include any codegen.
2016-06-16 12:29:46 -07:00
Igor Minar 26676c4833 docs(webworker): add/correct experimental markers to web worker apis 2016-06-15 17:12:40 -07:00
Igor Minar 933f45ef31 docs(webworkers): add experimental markers for all web worker public apis 2016-06-15 09:38:03 -07:00
Igor Minar 4fc37aeabd fix(webworkers): rename all web worker apis with "render" to "ui"
"render" is gramatically incorrect and confusing to developers who used this api.

Since webworker apis were exposed only in master, renaming these before the rc2 release
is not a breaking change
2016-06-15 09:38:03 -07:00
Kara 22916bb5d1 feat(forms): add easy way to switch between forms modules (#9202) 2016-06-14 18:23:40 -07:00
Igor Minar 6fc267f22c fix: split dynamic bits in platform-browser into platform-browser-dynamic
Previously these symbols were exposed via platform-browser-dynamic, then we merged then into platform-browser
thinking that tools would know how to shake off the compiler and other dynamic bits not used with the offline
compilation flow. This turned out to be wrong as both webpack and rollup don't have good enough tree-shaking
capabilities to do this today. We think that in the future we'll be able to merge these two entry points into
one, but we need to give tooling some time before we can do it. In the meantime the reintroduction of the -dynamic
package point allows us to separate the compiler dependencies from the rest of the framework.

This change undoes the previous breaking change that removed the platform-browser-dynamic package.
2016-06-14 15:31:24 -07:00
Tobias Bosch bc888bf3a1 refactor(compiler): Change arguments of `CompilerConfig` to named arguments
BREAKIKNG CHANGE:
`CompilerConfig` used to take positional arguments and now takes named arguments.

Closes #9172
2016-06-13 13:14:07 -07:00
Tobias Bosch 1745366530 refactor(compiler): make `PLATFORM_PIPES` / `PLATFORM_DIRECTIVES` an option on `CompilerConfig`
This aligns the configuration of platform pipes / directives with offline compilation.

BREAKING CHANGE:
- `PLATFORM_PIPES` and `PLATFORM_DIRECTIVES` now are fields on `CompilerConfig`. 
  Instead of providing a binding to these tokens, provide a binding for `CompilerConfig` instead.
2016-06-13 13:13:45 -07:00
ScottSWu 14a3ade662 chore(typescript): Changed double asterisks in #9100 to single asterisks
As in #9151, these comments are being read as JSDoc comments. This commit is smaller and only touches a few files that are causing errors.
2016-06-13 10:53:31 -07:00
Matias Niemelä 55860e1621 fix(animations): ensure AUTO styles are cleared at the end of the state-change animation
Closes #9014
Closes #9015
2016-06-11 00:08:41 -07:00
Matias Niemelä 4d51158b1a fix(animations): ensure the web-animations driver converts style props to camel-case
The web animations API now requires that all styles are converted to
camel case. Chrome has already made this breaking change and hyphenated
styles are not functional anymore.

Closes #9111
Closes #9112
2016-06-10 22:54:10 -07:00
Alex Eagle f39c9c9e75 style(lint): re-format modules/@angular 2016-06-09 17:00:15 -07:00
Victor Berchet 7ce0fc7d47 refactor: add types (#9116) 2016-06-09 11:04:15 -07:00
Martin Probst 346304762e feat(security): document <iframe src> to be TRUSTED_URL.
Docs on the DomSanitizationService didn't match actual usage before.

Also fixes some minor docs and implementation issues.
2016-06-08 20:49:15 -07:00
ScottSWu 86fbd50c3d refactor(TypeScript): Add noImplicitAny
We automatically insert explicit 'any's where needed. These need to be
addressed as in #9100.

Fixes #4924
2016-06-08 16:20:50 -07:00
Matias Niemelä e504d4eb05 fix(renderer): remove unecessary setElementStyles method
There is no need to expose this additional method inside of the Renderer
API. The functionality can be restored by looping and calling
`setElementStyle` instead.

Note that this change is changing code that was was introduced after
the last release therefore this fix is not a breaking change.

Closes #9000
Closes #9009
2016-06-03 15:20:34 -07:00
Victor Berchet a6ad61d83e refactor: change provide(...) for {provide: ...}
- provide() is deprecated,
- {} syntax is required by the offline compiler
2016-06-03 15:03:49 -07:00
Victor Berchet 27a47e7841 refactor(imports): simplify paths 2016-06-03 14:46:04 -07:00
Matias Niemelä fa0718ba9a feat(animations): provide support for offline compilation 2016-06-03 14:36:11 -07:00
Igor Minar dd6cb233b5 build: add missing testing.ts entry points to tsconfigs 2016-06-01 10:43:22 -07:00
Victor Berchet f2809d1ed8 fix(PostMessageBus):Add the worker scope to please Closure 2016-06-01 09:24:05 -07:00
Vikram Subramanian f4f6b8721a fix(core): Keep core exports seperate from core/testing exports. 2016-05-31 20:09:43 -07:00
Martin Probst 4d793c4eb8 feat(security): Automatic XSRF handling.
Automatically recognize XSRF protection cookies, and set a corresponding XSRF
header. Allows applications to configure the cookie names, or if needed,
completely override the XSRF request configuration by binding their own
XSRFHandler implementation.

Part of #8511.
2016-05-31 16:12:33 -07:00
Alex Eagle c6064a30a1 chore(package.json): make the packages installable 2016-05-27 17:21:34 -07:00
Alex Eagle 2019050db2 chore(lint): enable duplicateModuleImport tslint check 2016-05-27 09:17:08 -07:00
Matt Wheatley b7b56785d1 fix(Renderer): update signatures to make RenderDebugInfo optional
The code does not force the user to provider `RenderDebugInfo`. The
current implementation lists this as a mandatory parameter. Update
the parameter to be optional.

Fixes #8466

Closes #8859
2016-05-26 10:32:03 -07:00