cargdev/angular
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: disable sanitization for [style] and [style.prop] bindings (#35621)

Browse Source 
This patch is the first of many commits to disable sanitization for
[stlye.prop] and [style] bindings in Angular.

Historically, style-based sanitization has only been required for old
IE browsers (IE6 and IE7). Since Angular does not support these old
browsers at all, there is no reason for the framework to support
style-based sanitization.

PR Close #35621
This commit is contained in:
Matias Niemelä
2020-02-21 14:11:00 -08:00
committed by Alex Rickabaugh
parent 3c6c00d1d4
commit 420b9be1c1
13 changed files with 132 additions and 258 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
packages/core/test/linker/security_integration_spec.ts
View File

@ -238,26 +238,6 @@ function declareTests(config?: {useJit: boolean}) {
checkEscapeOfHrefProperty(fixture, true);
});
it('should escape unsafe style values', () => {
const template = `<div [style.background]="ctxProp">Text</div>`;
TestBed.overrideComponent(SecuredComponent, {set: {template}});
const fixture = TestBed.createComponent(SecuredComponent);
const e = fixture.debugElement.children[0].nativeElement;
const ci = fixture.componentInstance;
// Make sure binding harmless values works.
ci.ctxProp = 'red';
fixture.detectChanges();
// In some browsers, this will contain the full background specification, not just
// the color.
expect(e.style['background']).toMatch(/red.*/);
ci.ctxProp = 'url(javascript:evil())';
fixture.detectChanges();
// Updated value gets rejected, no value change.
expect(e.style['background']).not.toContain('javascript');
});
modifiedInIvy('Unknown property error thrown during update mode, not creation mode')
.it('should escape unsafe SVG attributes', () => {
const template = `<svg:circle [xlink:href]="ctxProp">Text</svg:circle>`;