feat(security): warn users when sanitizing in dev mode.
This should help developers to figure out what's going on when the sanitizer strips some input. Fixes #8522.
This commit is contained in:
@ -1,3 +1,6 @@
|
||||
import {getDOM} from '../dom/dom_adapter';
|
||||
import {assertionsEnabled} from '../../src/facade/lang';
|
||||
|
||||
/**
|
||||
* Regular expression for safe style values.
|
||||
*
|
||||
@ -44,5 +47,10 @@ function hasBalancedQuotes(value: string) {
|
||||
export function sanitizeStyle(value: string): string {
|
||||
value = String(value); // Make sure it's actually a string.
|
||||
if (value.match(SAFE_STYLE_VALUE) && hasBalancedQuotes(value)) return value;
|
||||
|
||||
if (assertionsEnabled()) {
|
||||
getDOM().log('WARNING: sanitizing unsafe style value ' + value);
|
||||
}
|
||||
|
||||
return 'unsafe';
|
||||
}
|
||||
|
Reference in New Issue
Block a user