Escape the content of the strings so that it can be safely inserted into a comment node.
The issue is that HTML does not specify any way to escape comment end text inside the comment.
`<!-- The way you close a comment is with "-->". -->`. Above the `"-->"` is meant to be text
not an end to the comment. This can be created programmatically through DOM APIs.
```
div.innerHTML = div.innerHTML
```
One would expect that the above code would be safe to do, but it turns out that because comment
text is not escaped, the comment may contain text which will prematurely close the comment
opening up the application for XSS attack. (In SSR we programmatically create comment nodes which
may contain such text and expect them to be safe.)
This function escapes the comment text by looking for the closing char sequence `-->` and replace
it with `-_-_>` where the `_` is a zero width space `\u200B`. The result is that if a comment
contains `-->` text it will render normally but it will not cause the HTML parser to close the
comment.
PR Close#40136
When building the environment stamp, support two modes: release and snapshot
The release mode will always stamp using the current version of in the root package.json
and in snapshot mode will use a version stamp expressing a version based on the tag and
the number of commits from the tag.
PR Close#40095
The vim editor produces temporarily files that can end in both .swo and
.swp. This commits add .swp to the .gitignore so we don't accidentaly
commit temporary files.
PR Close#40094
The `deploy-to-firebase.js` tests rely on git info retrieved from the
`angular/angular` repository (via `git ls-remote ...`).
Previously, different calls to `git ls-remote ...` could return
different values if a new commit was pushed or a new branch was created
during test execution, resulting in errors ([example CI failure][1]).
This commit makes the tests more stable by memoizing the result of
`git ls-remote ...` and returning the same result for subsequent calls
with the same arguments (even if meanwhile the remote has been updated).
[1]: https://circleci.com/gh/angular/angular/877626
PR Close#40088
Angular has stopped to support browser that requires these CSS properties.
All supported browsers support standard CSS properties:
* @keyframes rule
* animation
PR Close#40084
Removed rule don't affect their component views.
The reason - the templates don't contain elements to which that rule is applied.
See https://angular.io/guide/view-encapsulation for more details
PR Close#40080
With this change we update the CLI docs template to seperate
the following the default and value types from the argument field.
This should make it clearer and more understandable
PR Close#40038
Removed rules don't affect their component views.
The reason - the templates don't contain elements to which that rules are applied.
See https://angular.io/guide/view-encapsulation for more details
PR Close#40069
Angular has stopped to support browser that requires these CSS properties.
All supported browsers support standard CSS properties:
* border-radius
* border-bottom-left-radius
* border-bottom-right-radius
PR Close#40066
With regard to the code in `router_module.ts`, the correct equivalent for `enabled`
should be` enabledBlocking` and not `enabledNonBlocking`.
PR Close#40061
This commit moves the code for cleaning jqLite/jQuery data on an element
to a re-usable helper function. This way it is easier to keep the code
consistent across all places where we need to clean data (now and in the
future).
PR Close#40045
Angular has stopped to support browser that requires these CSS properties.
All supported browsers support standard box-sizing CSS property
PR Close#40039
Currently the compiler treats something like `{{ '{{a}}' }}` as a nested
binding and throws an error, because it doesn't account for quotes
when it looks for binding characters. These changes add a bit of
logic to skip over text inside quotes when parsing.
Fixes#39601.
PR Close#39826
Currently the code sample displayed in this guide is not a valid.
The `trigger` is directly used in the `@Component` decorator.
It should instead be in the `animations` array of the `@Component` decorator.
PR Close#37262
With the migration to husky@5, the environment variable used to skip husky changed from
`HUSKY_SKIP_HOOKS` to `HUSKY`. To continue skipping husky during the merge process as
expected, the environment variable used is updated.
PR Close#40025
Previously, due to the way the AngularJS and Angular clean-up processes
interfere with each other when removing an AngularJS element that
contains a downgraded Angular component, the data associated with the
host element of the downgraded component was not removed. This data was
kept in an internal AngularJS cache, which prevented the element and
component instance from being garbage-collected, leading to memory
leaks.
This commit fixes this by ensuring the element data is explicitly
removed when cleaning up a downgraded component.
NOTE:
This is essentially the equivalent of #26209 but for downgraded (instead
of upgraded) components.
Fixes#39911Closes#39921
PR Close#39965
Joey Perrott