
Summary: This adds basic security hooks to Angular 2. * `SecurityContext` is a private API between core, compiler, and platform-browser. `SecurityContext` communicates what context a value is used in across template parser, compiler, and sanitization at runtime. * `SanitizationService` is the bare bones interface to sanitize values for a particular context. * `SchemaElementRegistry.securityContext(tagName, attributeOrPropertyName)` determines the security context for an attribute or property (it turns out attributes and properties match for the purposes of sanitization). Based on these hooks: * `DomSchemaElementRegistry` decides what sanitization applies in a particular context. * `DomSanitizationService` implements `SanitizationService` and adds *Safe Value*s, i.e. the ability to mark a value as safe and not requiring further sanitization. * `url_sanitizer` and `style_sanitizer` sanitize URLs and Styles, respectively (surprise!). `DomSanitizationService` is the default implementation bound for browser applications, in the three contexts (browser rendering, web worker rendering, server side rendering). BREAKING CHANGES: *** SECURITY WARNING *** Angular 2 Release Candidates do not implement proper contextual escaping yet. Make sure to correctly escape all values that go into the DOM. *** SECURITY WARNING *** Reviewers: IgorMinar Differential Revision: https://reviews.angular.io/D103
116 lines
4.5 KiB
TypeScript
116 lines
4.5 KiB
TypeScript
import {
|
|
Provider,
|
|
PLATFORM_INITIALIZER,
|
|
PLATFORM_DIRECTIVES,
|
|
PLATFORM_PIPES,
|
|
ExceptionHandler,
|
|
RootRenderer,
|
|
APPLICATION_COMMON_PROVIDERS,
|
|
PLATFORM_COMMON_PROVIDERS,
|
|
OpaqueToken,
|
|
Testability
|
|
} from '@angular/core';
|
|
import {wtfInit, SanitizationService} from '../core_private';
|
|
import {COMMON_DIRECTIVES, COMMON_PIPES, FORM_PROVIDERS} from '@angular/common';
|
|
import {
|
|
DomSanitizationService,
|
|
DomSanitizationServiceImpl
|
|
} from './security/dom_sanitization_service';
|
|
|
|
import {IS_DART} from './facade/lang';
|
|
import {BrowserDomAdapter} from './browser/browser_adapter';
|
|
import {BrowserGetTestability} from './browser/testability';
|
|
import {getDOM} from './dom/dom_adapter';
|
|
import {DOCUMENT} from './dom/dom_tokens';
|
|
import {EVENT_MANAGER_PLUGINS, EventManager} from './dom/events/event_manager';
|
|
import {DomRootRenderer, DomRootRenderer_} from './dom/dom_renderer';
|
|
import {SharedStylesHost} from './dom/shared_styles_host';
|
|
import {KeyEventsPlugin} from './dom/events/key_events';
|
|
import {ELEMENT_PROBE_PROVIDERS} from './dom/debug/ng_probe';
|
|
import {DomEventsPlugin} from './dom/events/dom_events';
|
|
import {
|
|
HAMMER_GESTURE_CONFIG,
|
|
HammerGestureConfig,
|
|
HammerGesturesPlugin
|
|
} from './dom/events/hammer_gestures';
|
|
import {DomSharedStylesHost} from './dom/shared_styles_host';
|
|
import {AnimationBuilder} from './animate/animation_builder';
|
|
import {BrowserDetails} from './animate/browser_details';
|
|
|
|
export {Title} from './browser/title';
|
|
export {BrowserDomAdapter} from './browser/browser_adapter';
|
|
export {enableDebugTools, disableDebugTools} from './browser/tools/tools';
|
|
export {By} from './dom/debug/by';
|
|
|
|
export const BROWSER_PLATFORM_MARKER =
|
|
/*@ts2dart_const*/ new OpaqueToken('BrowserPlatformMarker');
|
|
|
|
/**
|
|
* A set of providers to initialize the Angular platform in a web browser.
|
|
*
|
|
* Used automatically by `bootstrap`, or can be passed to {@link platform}.
|
|
*/
|
|
export const BROWSER_PROVIDERS: Array<any /*Type | Provider | any[]*/> = /*@ts2dart_const*/[
|
|
/*@ts2dart_Provider*/ {provide: BROWSER_PLATFORM_MARKER, useValue: true},
|
|
PLATFORM_COMMON_PROVIDERS,
|
|
/*@ts2dart_Provider*/ {provide: PLATFORM_INITIALIZER, useValue: initDomAdapter, multi: true},
|
|
];
|
|
|
|
function _exceptionHandler(): ExceptionHandler {
|
|
// !IS_DART is required because we must rethrow exceptions in JS,
|
|
// but must not rethrow exceptions in Dart
|
|
return new ExceptionHandler(getDOM(), !IS_DART);
|
|
}
|
|
|
|
function _document(): any {
|
|
return getDOM().defaultDoc();
|
|
}
|
|
|
|
export const BROWSER_SANITIZATION_PROVIDERS: Array<any> = /*@ts2dart_const*/[
|
|
/* @ts2dart_Provider */ {provide: SanitizationService, useExisting: DomSanitizationService},
|
|
/* @ts2dart_Provider */ {provide: DomSanitizationService, useClass: DomSanitizationServiceImpl},
|
|
];
|
|
|
|
/**
|
|
* A set of providers to initialize an Angular application in a web browser.
|
|
*
|
|
* Used automatically by `bootstrap`, or can be passed to {@link PlatformRef.application}.
|
|
*/
|
|
export const BROWSER_APP_COMMON_PROVIDERS: Array<any /*Type | Provider | any[]*/> =
|
|
/*@ts2dart_const*/[
|
|
APPLICATION_COMMON_PROVIDERS,
|
|
FORM_PROVIDERS,
|
|
BROWSER_SANITIZATION_PROVIDERS,
|
|
/* @ts2dart_Provider */ {provide: PLATFORM_PIPES, useValue: COMMON_PIPES, multi: true},
|
|
/* @ts2dart_Provider */ {provide: PLATFORM_DIRECTIVES, useValue: COMMON_DIRECTIVES, multi: true},
|
|
/* @ts2dart_Provider */ {provide: ExceptionHandler, useFactory: _exceptionHandler, deps: []},
|
|
/* @ts2dart_Provider */ {provide: DOCUMENT, useFactory: _document, deps: []},
|
|
/* @ts2dart_Provider */ {provide: EVENT_MANAGER_PLUGINS, useClass: DomEventsPlugin, multi: true},
|
|
/* @ts2dart_Provider */ {provide: EVENT_MANAGER_PLUGINS, useClass: KeyEventsPlugin, multi: true},
|
|
/* @ts2dart_Provider */ {provide: EVENT_MANAGER_PLUGINS, useClass: HammerGesturesPlugin, multi: true},
|
|
/* @ts2dart_Provider */ {provide: HAMMER_GESTURE_CONFIG, useClass: HammerGestureConfig},
|
|
/* @ts2dart_Provider */ {provide: DomRootRenderer, useClass: DomRootRenderer_},
|
|
/* @ts2dart_Provider */ {provide: RootRenderer, useExisting: DomRootRenderer},
|
|
/* @ts2dart_Provider */ {provide: SharedStylesHost, useExisting: DomSharedStylesHost},
|
|
DomSharedStylesHost,
|
|
Testability,
|
|
BrowserDetails,
|
|
AnimationBuilder,
|
|
EventManager,
|
|
ELEMENT_PROBE_PROVIDERS
|
|
];
|
|
|
|
|
|
export {
|
|
HAMMER_GESTURE_CONFIG,
|
|
HammerGestureConfig
|
|
} from '../src/dom/events/hammer_gestures'
|
|
|
|
|
|
export function
|
|
initDomAdapter() {
|
|
BrowserDomAdapter.makeCurrent();
|
|
wtfInit();
|
|
BrowserGetTestability.init();
|
|
}
|