Configure Firebase to serve a CSP header on angular.io that enables
Trusted Types in report-only mode. This causes any Trusted Types
violations that may occur as users browser angular.io to generate a CSP
report that is sent to csp.withgoogle.com, where it is processed by
Google's CSP report collector.
This is a non-breaking change that allows us to evaluate whether
angular.io is fully compatible with Trusted Types, at which point we can
start enforcing Trusted Types.
PR Close#43406
Configure angular.json to serve a CSP header that enabled Trusted Types
in enforcement mode, both in e2e tests and when running the local
development server. This should help prevent regressions related to
Trusted Types in the angular.io app.
PR Close#43406
Fix a Trusted Types violation in ServiceWorkerModule that occurs when
initializing the service worker from a string URL, by passing a
TrustedScriptURL instead.
PR Close#43406
Change SvgIconInfo.svgSource to be a TrustedHTML and update all its
users accordingly. Also introduce the svg template tag function for
building TrustedHTML from constant SVG sources.
PR Close#43406
Change the PrettyPrinter interface to accept a TrustedHTML and patch
prettify.js so that it makes use of that value without modification.
Update all users of the service to produce, and pass in a TrustedHTML.
PR Close#43406
Also introduce a dependency on the Trusted Types type definitions and a
Trusted Types polyfill, safevalues. Create a security module for common,
security-reviewed transformations into Trusted Types.
PR Close#43406
The Google Analytics snippet loads its runtime by dynamically creating a
script element and assigning a URL to its src attribute. This causes a
Trusted Types violation.
To fix this, create an inline Trusted Types policy called 'aio#analytics'
to bless the script URL, which is a trusted constant.
PR Close#43406
* Document `currentUrlTree`, `browserUrlTree`, and `rawUrlTree`
* Add a couple `TODO` comments to investigate changes based on understanding
PR Close#43391
This restores the `finalize` function to directly call
`resetUrlToCurrentUrlTree`, as it was before efb440eb2f.
This allows us to simplify the `restoreHistory` function because it no
longer needs to handle the call from `finalize` where it should not
reset the internal router state.
PR Close#43382
The file we are redirecting `/guide/bazel` to was moved from
`bazel/src/schematics/README.md` to `bazel/docs/BAZEL_SCHEMATICS.md` in
commit 71b8c9ab29.
Update the Firebase configuration to use the new path in the redirect
URL.
PR Close#43376
The TODO comment suggesting to verify that the target element to
scroll to needs to be an anchor does not longer seems under consideration
so it can be removed
resolves#43348
PR Close#43378
Windows disallows removal of files which are currently being used.
i.e. have active handles. This currently can result in permission denied
failures on the Windows CI jobs where `yarn bazel` resolves to the local
bazelisk installation that can be unlinked by `yarn_install` repository
fetching as part of the Bazel invocation, resulting in errors like:
```
ERROR: An error occurred during the fetch of repository 'npm':
yarn_install failed: $ node tools/yarn/check-yarn.js
...
[4/5] Linking dependencies...
info If you think this is a bug, please open a bug report with the information provided in "C:\\users\\circleci\\ng\\yarn-error.log".
info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.
(warning " > tsickle@0.34.3" has incorrect peer dependency "typescript@~3.3.1".
error An unexpected error occurred: "EPERM: operation not permitted, unlink 'C:\\users\\circleci\\ng\\node_modules\\@bazel\\bazel-win32_x64\\bazel-0.27.0-windows-x86_64.exe'".
Process stalled
Active handles:
- Socket
- Socket
- Socket
)
```
We workarund this in order to improve CI stability in case the node modules are
being invalidated by Bazel, or through Yarns integrity checking.
PR Close#43365
Checks the `.ng-dev` tool configuration in CI, compared
to doing it locally when the caretaker intends to perform
a merge and then realizes the config is broken.
PR Close#43365
Updates the overall Bazel setup to their latest versions:
* rules_nodejs is updated to stable 4.0.0
* rules_sass is updated to the latest version containing a fix
for the `@bazel/worker` bug we had a workaround for.
* dev-infra-private is updated to avoid duplicated dependencies.
We should use a version that also relies on stable rules_nodejs v4.
Note: We are not set on how dependencies for the `bazel/` folder
of the dev-infra package are managed, but we removed `@types/`
packages from the transitive dependencies, so we now need to
manually include `@types/uuid` for building the benchmark driver
utilties. We need to revisit this in the future.
PR Close#43365
Previously, the error message was not added to `Unhandled Navigation Error`
Before
```
main.js:1 Unhandled Navigation Errors:
```
After
```
main.js:1 Unhandled Navigation Errors: SecurityError: Failed to execute 'replaceState' on 'History': A history state object with URL 'http://localhost:4200/' cannot be created in a document with origin 'http://127.0.0.1:8080' and URL 'http://127.0.0.1:8080/'.
```
PR Close#43291
The getting-started tutorial at angular.io/start instructs users to
generate a `ProductAlertsComponent` using the "Angular generator"
feature in [StackBlitz](https://stackblitz.com/). However, unlike the
Angular CLI, generating a component in StackBlitz does not automatically
declare it in `AppModule`, which is a requirement for the component to
be used in the application. This resulted in a compile error when
following the tutorial instructions.
This commit fixes this by adding a step to manually import and declare
the newly generated component in `app.module.ts`.
Fixes#43020Closes#43212
PR Close#43229
Add an abstract class that has a default implementation of the run
function and visits all nodes. Authors of template checks can extend
this class and override the `visitNode` method to return diagnostics.
Refs #42966
PR Close#43232
Bjarki