tsec is a TypeScript compiler wrapper for restricting use of
security-sensitive DOM APIs, in particular those that could lead to XSS
or Trusted Types violations. Add it as a linter to aio to prevent future
Trusted Types regressions on angular.io.
Also introduces security_exemptions.json, which lists the known,
security-reviewed tsec security violations. New entries can only be
added to this file after a security review, in particular making sure
that the corresponding code does not cause XSS vulnerabilities or
Trusted Types violations.
PR Close#42800
Configure Firebase to serve a CSP header on angular.io that enables
Trusted Types in report-only mode. This causes any Trusted Types
violations that may occur as users browser angular.io to generate a CSP
report that is sent to csp.withgoogle.com, where it is processed by
Google's CSP report collector.
This is a non-breaking change that allows us to evaluate whether
angular.io is fully compatible with Trusted Types, at which point we can
start enforcing Trusted Types.
PR Close#42800
Configure angular.json to serve a CSP header that enabled Trusted Types
in enforcement mode, both in e2e tests and when running the local
development server. This should help prevent regressions related to
Trusted Types in the angular.io app.
PR Close#42800
Fix a Trusted Types violation in ServiceWorkerModule that occurs when
initializing the service worker from a string URL, by passing a
TrustedScriptURL instead.
PR Close#42800
Change SvgIconInfo.svgSource to be a TrustedHTML and update all its
users accordingly. Also introduce the svg template tag function for
building TrustedHTML from constant SVG sources.
PR Close#42800
Change the PrettyPrinter interface to accept a TrustedHTML and patch
prettify.js so that it makes use of that value without modification.
Update all users of the service to produce, and pass in a TrustedHTML.
PR Close#42800
Also introduce a dependency on the Trusted Types type definitions and a
Trusted Types polyfill, safevalues. Create a security module for common,
security-reviewed transformations into Trusted Types.
PR Close#42800
The Google Analytics snippet loads its runtime by dynamically creating a
script element and assigning a URL to its src attribute. This causes a
Trusted Types violation.
To fix this, create an inline Trusted Types policy called 'aio#analytics'
to bless the script URL, which is a trusted constant.
PR Close#42800
The file we are redirecting `/guide/bazel` to was moved from
`bazel/src/schematics/README.md` to `bazel/docs/BAZEL_SCHEMATICS.md` in
commit 71b8c9ab29.
Update the Firebase configuration to use the new path in the redirect
URL.
PR Close#43376
Support for IE11 has been dropped in v13. IE11 was the last browser officially support by Angular that required ES5 code. As a result of its removal, differential loading is no longer required and the Angular CLI has removed all differential loading functional for v13. This commit removes all references to differential loading from the documentation.
PR Close#43060
Support for IE 11 was deprecated in v12 and in v13 the support is fully dropped. This commit updates the browser compatibility docs and removes IE 11 as a supported browser.
PR Close#43034
The getting-started tutorial at angular.io/start instructs users to
generate a `ProductAlertsComponent` using the "Angular generator"
feature in [StackBlitz](https://stackblitz.com/). However, unlike the
Angular CLI, generating a component in StackBlitz does not automatically
declare it in `AppModule`, which is a requirement for the component to
be used in the application. This resulted in a compile error when
following the tutorial instructions.
This commit fixes this by adding a step to manually import and declare
the newly generated component in `app.module.ts`.
Fixes#43020Closes#43212
PR Close#43229
Update links and formatting prior to creating sub-topics.
Update links to reference links for consistency. Update formatting for code sections. Updated list alignment for consistent formatting.
PR Close#43066
The previously used code (`<live-example stackblitz="router">`) would
try to target the `router.stackblitz.json` file inside the
(non-existent) `routing-overview` example (same as the guide's name).
This commit fixes the code to correctly express the original intention
of targeting the default `stackblitz.json` file of the `router` example
with `<live-example name="router">`.
Fixes#43167
PR Close#43180
There are small typos in:
- aio/content/guide/universal.md
- aio/content/guide/upgrade.md
- aio/content/guide/workspace-config.md
- dev-infra/ng-dev.js
- integration/check-dependencies.js
Fixes:
- Should read `mergeable` rather than `mergable`.
- Should read `upgradeable` rather than `upgradable`.
- Should read `thresholds` rather than `threshholds`.
- Should read `lease` rather than `leage`.
- Should read `ignore` rather than `ingore`.
- Should read `bootstrapping` rather than `bootstraping`.
PR Close#43051
Amadou Sall