').append(element).html();
try {
return element[0].nodeType === NODE_TYPE_TEXT ? lowercase(elemHtml) :
@@ -11363,30 +11891,52 @@ function getNgAttribute(element, ngAttr) {
}
function allowAutoBootstrap(document) {
- if (!document.currentScript) {
+ var script = document.currentScript;
+
+ if (!script) {
+ // Support: IE 9-11 only
+ // IE does not have `document.currentScript`
return true;
}
- var src = document.currentScript.getAttribute('src');
- var link = document.createElement('a');
- link.href = src;
- if (document.location.origin === link.origin) {
- // Same-origin resources are always allowed, even for non-whitelisted schemes.
- return true;
+
+ // If the `currentScript` property has been clobbered just return false, since this indicates a probable attack
+ if (!(script instanceof window.HTMLScriptElement || script instanceof window.SVGScriptElement)) {
+ return false;
}
- // Disabled bootstrapping unless angular.js was loaded from a known scheme used on the web.
- // This is to prevent angular.js bundled with browser extensions from being used to bypass the
- // content security policy in web pages and other browser extensions.
- switch (link.protocol) {
- case 'http:':
- case 'https:':
- case 'ftp:':
- case 'blob:':
- case 'file:':
- case 'data:':
+
+ var attributes = script.attributes;
+ var srcs = [attributes.getNamedItem('src'), attributes.getNamedItem('href'), attributes.getNamedItem('xlink:href')];
+
+ return srcs.every(function(src) {
+ if (!src) {
return true;
- default:
+ }
+ if (!src.value) {
return false;
- }
+ }
+
+ var link = document.createElement('a');
+ link.href = src.value;
+
+ if (document.location.origin === link.origin) {
+ // Same-origin resources are always allowed, even for non-whitelisted schemes.
+ return true;
+ }
+ // Disabled bootstrapping unless angular.js was loaded from a known scheme used on the web.
+ // This is to prevent angular.js bundled with browser extensions from being used to bypass the
+ // content security policy in web pages and other browser extensions.
+ switch (link.protocol) {
+ case 'http:':
+ case 'https:':
+ case 'ftp:':
+ case 'blob:':
+ case 'file:':
+ case 'data:':
+ return true;
+ default:
+ return false;
+ }
+ });
}
// Cached as it has to run during loading so that document.currentScript is available.
@@ -11750,7 +12300,7 @@ function bindJQuery() {
extend(jQuery.fn, {
scope: JQLitePrototype.scope,
isolateScope: JQLitePrototype.isolateScope,
- controller: JQLitePrototype.controller,
+ controller: /** @type {?} */ (JQLitePrototype).controller,
injector: JQLitePrototype.injector,
inheritedData: JQLitePrototype.inheritedData
});
@@ -11983,6 +12533,9 @@ function setupModuleLoader(window) {
* @returns {angular.Module} new module with the {@link angular.Module} api.
*/
return function module(name, requires, configFn) {
+
+ var info = {};
+
var assertNotHasOwnProperty = function(name, context) {
if (name === 'hasOwnProperty') {
throw ngMinErr('badname', 'hasOwnProperty is not a valid {0} name', context);
@@ -12018,6 +12571,45 @@ function setupModuleLoader(window) {
_configBlocks: configBlocks,
_runBlocks: runBlocks,
+ /**
+ * @ngdoc method
+ * @name angular.Module#info
+ * @module ng
+ *
+ * @param {Object=} info Information about the module
+ * @returns {Object|Module} The current info object for this module if called as a getter,
+ * or `this` if called as a setter.
+ *
+ * @description
+ * Read and write custom information about this module.
+ * For example you could put the version of the module in here.
+ *
+ * ```js
+ * angular.module('myModule', []).info({ version: '1.0.0' });
+ * ```
+ *
+ * The version could then be read back out by accessing the module elsewhere:
+ *
+ * ```
+ * var version = angular.module('myModule').info().version;
+ * ```
+ *
+ * You can also retrieve this information during runtime via the
+ * {@link $injector#modules `$injector.modules`} property:
+ *
+ * ```js
+ * var version = $injector.modules['myModule'].info().version;
+ * ```
+ */
+ info: function(value) {
+ if (isDefined(value)) {
+ if (!isObject(value)) throw ngMinErr('aobj', 'Argument \'{0}\' must be an object', 'value');
+ info = value;
+ return this;
+ }
+ return info;
+ },
+
/**
* @ngdoc property
* @name angular.Module#requires
@@ -12294,11 +12886,19 @@ function shallowCopy(src, dst) {
return dst || src;
}
-/* global toDebugString: true */
+/* exported toDebugString */
-function serializeObject(obj) {
+function serializeObject(obj, maxDepth) {
var seen = [];
+ // There is no direct way to stringify object until reaching a specific depth
+ // and a very deep object can cause a performance issue, so we copy the object
+ // based on this specific depth and then stringify it.
+ if (isValidObjectMaxDepth(maxDepth)) {
+ // This file is also included in `angular-loader`, so `copy()` might not always be available in
+ // the closure. Therefore, it is lazily retrieved as `angular.copy()` when needed.
+ obj = angular.copy(obj, null, maxDepth);
+ }
return JSON.stringify(obj, function(key, val) {
val = toJsonReplacer(key, val);
if (isObject(val)) {
@@ -12311,13 +12911,13 @@ function serializeObject(obj) {
});
}
-function toDebugString(obj) {
+function toDebugString(obj, maxDepth) {
if (typeof obj === 'function') {
return obj.toString().replace(/ \{[\s\S]*$/, '');
} else if (isUndefined(obj)) {
return 'undefined';
} else if (typeof obj !== 'string') {
- return serializeObject(obj);
+ return serializeObject(obj, maxDepth);
}
return obj;
}
@@ -12392,7 +12992,6 @@ function toDebugString(obj) {
$$ForceReflowProvider,
$InterpolateProvider,
$IntervalProvider,
- $$HashMapProvider,
$HttpProvider,
$HttpParamSerializerProvider,
$HttpParamSerializerJQLikeProvider,
@@ -12401,6 +13000,7 @@ function toDebugString(obj) {
$jsonpCallbacksProvider,
$LocationProvider,
$LogProvider,
+ $$MapProvider,
$ParseProvider,
$RootScopeProvider,
$QProvider,
@@ -12438,16 +13038,17 @@ function toDebugString(obj) {
var version = {
// These placeholder strings will be replaced by grunt's `build` task.
// They need to be double- or single-quoted.
- full: '1.6.1',
+ full: '1.6.5',
major: 1,
minor: 6,
- dot: 1,
- codeName: 'promise-rectification'
+ dot: 5,
+ codeName: 'toffee-salinization'
};
function publishExternalAPI(angular) {
extend(angular, {
+ 'errorHandlingConfig': errorHandlingConfig,
'bootstrap': bootstrap,
'copy': copy,
'extend': extend,
@@ -12582,11 +13183,12 @@ function publishExternalAPI(angular) {
$window: $WindowProvider,
$$rAF: $$RAFProvider,
$$jqLite: $$jqLiteProvider,
- $$HashMap: $$HashMapProvider,
+ $$Map: $$MapProvider,
$$cookieReader: $$CookieReaderProvider
});
}
- ]);
+ ])
+ .info({ angularVersion: '1.6.5' });
}
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
@@ -12790,12 +13392,6 @@ function jqLiteHasData(node) {
return false;
}
-function jqLiteCleanData(nodes) {
- for (var i = 0, ii = nodes.length; i < ii; i++) {
- jqLiteRemoveData(nodes[i]);
- }
-}
-
function jqLiteBuildFragment(html, context) {
var tmp, tag, wrap,
fragment = context.createDocumentFragment(),
@@ -12898,13 +13494,10 @@ function jqLiteClone(element) {
}
function jqLiteDealoc(element, onlyDescendants) {
- if (!onlyDescendants) jqLiteRemoveData(element);
+ if (!onlyDescendants && jqLiteAcceptsData(element)) jqLite.cleanData([element]);
if (element.querySelectorAll) {
- var descendants = element.querySelectorAll('*');
- for (var i = 0, l = descendants.length; i < l; i++) {
- jqLiteRemoveData(descendants[i]);
- }
+ jqLite.cleanData(element.querySelectorAll('*'));
}
}
@@ -13202,7 +13795,11 @@ forEach({
data: jqLiteData,
removeData: jqLiteRemoveData,
hasData: jqLiteHasData,
- cleanData: jqLiteCleanData
+ cleanData: function jqLiteCleanData(nodes) {
+ for (var i = 0, ii = nodes.length; i < ii; i++) {
+ jqLiteRemoveData(nodes[i]);
+ }
+ }
}, function(fn, name) {
JQLite[name] = fn;
});
@@ -13730,50 +14327,70 @@ function hashKey(obj, nextUidFn) {
return key;
}
-/**
- * HashMap which can use objects as keys
- */
-function HashMap(array, isolatedUid) {
- if (isolatedUid) {
- var uid = 0;
- this.nextUid = function() {
- return ++uid;
- };
- }
- forEach(array, this.put, this);
+// A minimal ES2015 Map implementation.
+// Should be bug/feature equivalent to the native implementations of supported browsers
+// (for the features required in Angular).
+// See https://kangax.github.io/compat-table/es6/#test-Map
+var nanKey = Object.create(null);
+function NgMapShim() {
+ this._keys = [];
+ this._values = [];
+ this._lastKey = NaN;
+ this._lastIndex = -1;
}
-HashMap.prototype = {
- /**
- * Store key value pair
- * @param key key to store can be any type
- * @param value value to store can be any type
- */
- put: function(key, value) {
- this[hashKey(key, this.nextUid)] = value;
+NgMapShim.prototype = {
+ _idx: function(key) {
+ if (key === this._lastKey) {
+ return this._lastIndex;
+ }
+ this._lastKey = key;
+ this._lastIndex = this._keys.indexOf(key);
+ return this._lastIndex;
+ },
+ _transformKey: function(key) {
+ return isNumberNaN(key) ? nanKey : key;
},
-
- /**
- * @param key
- * @returns {Object} the value for the key
- */
get: function(key) {
- return this[hashKey(key, this.nextUid)];
+ key = this._transformKey(key);
+ var idx = this._idx(key);
+ if (idx !== -1) {
+ return this._values[idx];
+ }
},
+ set: function(key, value) {
+ key = this._transformKey(key);
+ var idx = this._idx(key);
+ if (idx === -1) {
+ idx = this._lastIndex = this._keys.length;
+ }
+ this._keys[idx] = key;
+ this._values[idx] = value;
- /**
- * Remove the key/value pair
- * @param key
- */
- remove: function(key) {
- var value = this[key = hashKey(key, this.nextUid)];
- delete this[key];
- return value;
+ // Support: IE11
+ // Do not `return this` to simulate the partial IE11 implementation
+ },
+ delete: function(key) {
+ key = this._transformKey(key);
+ var idx = this._idx(key);
+ if (idx === -1) {
+ return false;
+ }
+ this._keys.splice(idx, 1);
+ this._values.splice(idx, 1);
+ this._lastKey = NaN;
+ this._lastIndex = -1;
+ return true;
}
};
-var $$HashMapProvider = [/** @this */function() {
+// For now, always use `NgMapShim`, even if `window.Map` is available. Some native implementations
+// are still buggy (often in subtle ways) and can cause hard-to-debug failures. When native `Map`
+// implementations get more stable, we can reconsider switching to `window.Map` (when available).
+var NgMap = NgMapShim;
+
+var $$MapProvider = [/** @this */function() {
this.$get = [function() {
- return HashMap;
+ return NgMap;
}];
}];
@@ -13848,11 +14465,7 @@ var STRIP_COMMENTS = /((\/\/.*$)|(\/\*[\s\S]*?\*\/))/mg;
var $injectorMinErr = minErr('$injector');
function stringifyFn(fn) {
- // Support: Chrome 50-51 only
- // Creating a new string by adding `' '` at the end, to hack around some bug in Chrome v50/51
- // (See https://github.com/angular/angular.js/issues/14487.)
- // TODO (gkalpak): Remove workaround when Chrome v52 is released
- return Function.prototype.toString.call(fn) + ' ';
+ return Function.prototype.toString.call(fn);
}
function extractArgs(fn) {
@@ -13961,6 +14574,28 @@ function annotate(fn, strictDi, name) {
* As an array of injection names, where the last item in the array is the function to call.
*/
+/**
+ * @ngdoc property
+ * @name $injector#modules
+ * @type {Object}
+ * @description
+ * A hash containing all the modules that have been loaded into the
+ * $injector.
+ *
+ * You can use this property to find out information about a module via the
+ * {@link angular.Module#info `myModule.info(...)`} method.
+ *
+ * For example:
+ *
+ * ```
+ * var info = $injector.modules['ngAnimate'].info();
+ * ```
+ *
+ * **Do not use this property to attempt to modify the modules after the application
+ * has been bootstrapped.**
+ */
+
+
/**
* @ngdoc method
* @name $injector#get
@@ -14426,7 +15061,7 @@ function createInjector(modulesToLoad, strictDi) {
var INSTANTIATING = {},
providerSuffix = 'Provider',
path = [],
- loadedModules = new HashMap([], true),
+ loadedModules = new NgMap(),
providerCache = {
$provide: {
provider: supportObject(provider),
@@ -14454,6 +15089,7 @@ function createInjector(modulesToLoad, strictDi) {
instanceInjector = protoInstanceInjector;
providerCache['$injector' + providerSuffix] = { $get: valueFn(protoInstanceInjector) };
+ instanceInjector.modules = providerInjector.modules = createMap();
var runBlocks = loadModules(modulesToLoad);
instanceInjector = protoInstanceInjector.get('$injector');
instanceInjector.strictDi = strictDi;
@@ -14534,7 +15170,7 @@ function createInjector(modulesToLoad, strictDi) {
var runBlocks = [], moduleFn;
forEach(modulesToLoad, function(module) {
if (loadedModules.get(module)) return;
- loadedModules.put(module, true);
+ loadedModules.set(module, true);
function runInvokeQueue(queue) {
var i, ii;
@@ -14549,6 +15185,7 @@ function createInjector(modulesToLoad, strictDi) {
try {
if (isString(module)) {
moduleFn = angularModule(module);
+ instanceInjector.modules[module] = moduleFn;
runBlocks = runBlocks.concat(loadModules(moduleFn.requires)).concat(moduleFn._runBlocks);
runInvokeQueue(moduleFn._invokeQueue);
runInvokeQueue(moduleFn._configBlocks);
@@ -15020,7 +15657,7 @@ var $$CoreAnimateJsProvider = /** @this */ function() {
// this is prefixed with Core since it conflicts with
// the animateQueueProvider defined in ngAnimate/animateQueue.js
var $$CoreAnimateQueueProvider = /** @this */ function() {
- var postDigestQueue = new HashMap();
+ var postDigestQueue = new NgMap();
var postDigestElements = [];
this.$get = ['$$AnimateRunner', '$rootScope',
@@ -15099,7 +15736,7 @@ var $$CoreAnimateQueueProvider = /** @this */ function() {
jqLiteRemoveClass(elm, toRemove);
}
});
- postDigestQueue.remove(element);
+ postDigestQueue.delete(element);
}
});
postDigestElements.length = 0;
@@ -15114,7 +15751,7 @@ var $$CoreAnimateQueueProvider = /** @this */ function() {
if (classesAdded || classesRemoved) {
- postDigestQueue.put(element, data);
+ postDigestQueue.set(element, data);
postDigestElements.push(element);
if (postDigestElements.length === 1) {
@@ -15139,6 +15776,8 @@ var $$CoreAnimateQueueProvider = /** @this */ function() {
*/
var $AnimateProvider = ['$provide', /** @this */ function($provide) {
var provider = this;
+ var classNameFilter = null;
+ var customFilter = null;
this.$$registeredAnimations = Object.create(null);
@@ -15191,6 +15830,51 @@ var $AnimateProvider = ['$provide', /** @this */ function($provide) {
$provide.factory(key, factory);
};
+ /**
+ * @ngdoc method
+ * @name $animateProvider#customFilter
+ *
+ * @description
+ * Sets and/or returns the custom filter function that is used to "filter" animations, i.e.
+ * determine if an animation is allowed or not. When no filter is specified (the default), no
+ * animation will be blocked. Setting the `customFilter` value will only allow animations for
+ * which the filter function's return value is truthy.
+ *
+ * This allows to easily create arbitrarily complex rules for filtering animations, such as
+ * allowing specific events only, or enabling animations on specific subtrees of the DOM, etc.
+ * Filtering animations can also boost performance for low-powered devices, as well as
+ * applications containing a lot of structural operations.
+ *
+ *
+ * **Best Practice:**
+ * Keep the filtering function as lean as possible, because it will be called for each DOM
+ * action (e.g. insertion, removal, class change) performed by "animation-aware" directives.
+ * See {@link guide/animations#which-directives-support-animations- here} for a list of built-in
+ * directives that support animations.
+ * Performing computationally expensive or time-consuming operations on each call of the
+ * filtering function can make your animations sluggish.
+ *
+ *
+ * **Note:** If present, `customFilter` will be checked before
+ * {@link $animateProvider#classNameFilter classNameFilter}.
+ *
+ * @param {Function=} filterFn - The filter function which will be used to filter all animations.
+ * If a falsy value is returned, no animation will be performed. The function will be called
+ * with the following arguments:
+ * - **node** `{DOMElement}` - The DOM element to be animated.
+ * - **event** `{String}` - The name of the animation event (e.g. `enter`, `leave`, `addClass`
+ * etc).
+ * - **options** `{Object}` - A collection of options/styles used for the animation.
+ * @return {Function} The current filter function or `null` if there is none set.
+ */
+ this.customFilter = function(filterFn) {
+ if (arguments.length === 1) {
+ customFilter = isFunction(filterFn) ? filterFn : null;
+ }
+
+ return customFilter;
+ };
+
/**
* @ngdoc method
* @name $animateProvider#classNameFilter
@@ -15202,20 +15886,26 @@ var $AnimateProvider = ['$provide', /** @this */ function($provide) {
* When setting the `classNameFilter` value, animations will only be performed on elements
* that successfully match the filter expression. This in turn can boost performance
* for low-powered devices as well as applications containing a lot of structural operations.
+ *
+ * **Note:** If present, `classNameFilter` will be checked after
+ * {@link $animateProvider#customFilter customFilter}. If `customFilter` is present and returns
+ * false, `classNameFilter` will not be checked.
+ *
* @param {RegExp=} expression The className expression which will be checked against all animations
* @return {RegExp} The current CSS className expression value. If null then there is no expression value
*/
this.classNameFilter = function(expression) {
if (arguments.length === 1) {
- this.$$classNameFilter = (expression instanceof RegExp) ? expression : null;
- if (this.$$classNameFilter) {
- var reservedRegex = new RegExp('(\\s+|\\/)' + NG_ANIMATE_CLASSNAME + '(\\s+|\\/)');
- if (reservedRegex.test(this.$$classNameFilter.toString())) {
- throw $animateMinErr('nongcls','$animateProvider.classNameFilter(regex) prohibits accepting a regex value which matches/contains the "{0}" CSS class.', NG_ANIMATE_CLASSNAME);
+ classNameFilter = (expression instanceof RegExp) ? expression : null;
+ if (classNameFilter) {
+ var reservedRegex = new RegExp('[(\\s|\\/)]' + NG_ANIMATE_CLASSNAME + '[(\\s|\\/)]');
+ if (reservedRegex.test(classNameFilter.toString())) {
+ classNameFilter = null;
+ throw $animateMinErr('nongcls', '$animateProvider.classNameFilter(regex) prohibits accepting a regex value which matches/contains the "{0}" CSS class.', NG_ANIMATE_CLASSNAME);
}
}
}
- return this.$$classNameFilter;
+ return classNameFilter;
};
this.$get = ['$$animateQueue', function($$animateQueue) {
@@ -15974,7 +16664,6 @@ function Browser(window, document, $log, $sniffer) {
};
cacheState();
- lastHistoryState = cachedState;
/**
* @name $browser#url
@@ -16028,8 +16717,6 @@ function Browser(window, document, $log, $sniffer) {
if ($sniffer.history && (!sameBase || !sameState)) {
history[replace ? 'replaceState' : 'pushState'](state, '', url);
cacheState();
- // Do the assignment again so that those two variables are referentially identical.
- lastHistoryState = cachedState;
} else {
if (!sameBase) {
pendingLocation = url;
@@ -16078,8 +16765,7 @@ function Browser(window, document, $log, $sniffer) {
function cacheStateAndFireUrlChange() {
pendingLocation = null;
- cacheState();
- fireUrlChange();
+ fireStateOrUrlChange();
}
// This variable should be used *only* inside the cacheState function.
@@ -16093,11 +16779,16 @@ function Browser(window, document, $log, $sniffer) {
if (equals(cachedState, lastCachedState)) {
cachedState = lastCachedState;
}
+
lastCachedState = cachedState;
+ lastHistoryState = cachedState;
}
- function fireUrlChange() {
- if (lastBrowserUrl === self.url() && lastHistoryState === cachedState) {
+ function fireStateOrUrlChange() {
+ var prevLastHistoryState = lastHistoryState;
+ cacheState();
+
+ if (lastBrowserUrl === self.url() && prevLastHistoryState === cachedState) {
return;
}
@@ -16132,8 +16823,8 @@ function Browser(window, document, $log, $sniffer) {
self.onUrlChange = function(callback) {
// TODO(vojta): refactor to use node's syntax for events
if (!urlChangeInit) {
- // We listen on both (hashchange/popstate) when available, as some browsers (e.g. Opera)
- // don't fire popstate when user change the address bar and don't fire hashchange when url
+ // We listen on both (hashchange/popstate) when available, as some browsers don't
+ // fire popstate when user changes the address bar and don't fire hashchange when url
// changed by push/replaceState
// html5 history api - popstate event
@@ -16163,7 +16854,7 @@ function Browser(window, document, $log, $sniffer) {
* Needs to be exported to be able to check for changes that have been done in sync,
* as hashchange/popstate events fire in async.
*/
- self.$$checkUrlChange = fireUrlChange;
+ self.$$checkUrlChange = fireStateOrUrlChange;
//////////////////////////////////////////////////////////////
// Misc API
@@ -16773,7 +17464,8 @@ function $TemplateCacheProvider() {
* * `$onChanges(changesObj)` - Called whenever one-way (`<`) or interpolation (`@`) bindings are updated. The
* `changesObj` is a hash whose keys are the names of the bound properties that have changed, and the values are an
* object of the form `{ currentValue, previousValue, isFirstChange() }`. Use this hook to trigger updates within a
- * component such as cloning the bound value to prevent accidental mutation of the outer value.
+ * component such as cloning the bound value to prevent accidental mutation of the outer value. Note that this will
+ * also be called when your bindings are initialized.
* * `$doCheck()` - Called on each turn of the digest cycle. Provides an opportunity to detect and act on
* changes. Any actions that you wish to take in response to the changes that you detect must be
* invoked from this hook; implementing this has no effect on when `$onChanges` is called. For example, this hook
@@ -16921,10 +17613,12 @@ function $TemplateCacheProvider() {
* the directive's element. If multiple directives on the same element request a new scope,
* only one new scope is created.
*
- * * **`{...}` (an object hash):** A new "isolate" scope is created for the directive's element. The
- * 'isolate' scope differs from normal scope in that it does not prototypically inherit from its parent
- * scope. This is useful when creating reusable components, which should not accidentally read or modify
- * data in the parent scope.
+ * * **`{...}` (an object hash):** A new "isolate" scope is created for the directive's template.
+ * The 'isolate' scope differs from normal scope in that it does not prototypically
+ * inherit from its parent scope. This is useful when creating reusable components, which should not
+ * accidentally read or modify data in the parent scope. Note that an isolate scope
+ * directive without a `template` or `templateUrl` will not apply the isolate scope
+ * to its children elements.
*
* The 'isolate' scope object hash defines a set of local scope properties derived from attributes on the
* directive's element. These local properties are useful for aliasing values for templates. The keys in
@@ -17017,9 +17711,9 @@ function $TemplateCacheProvider() {
* initialized.
*
*
- * **Deprecation warning:** although bindings for non-ES6 class controllers are currently
- * bound to `this` before the controller constructor is called, this use is now deprecated. Please place initialization
- * code that relies upon bindings inside a `$onInit` method on the controller, instead.
+ * **Deprecation warning:** if `$compileProcvider.preAssignBindingsEnabled(true)` was called, bindings for non-ES6 class
+ * controllers are bound to `this` before the controller constructor is called but this use is now deprecated. Please
+ * place initialization code that relies upon bindings inside a `$onInit` method on the controller, instead.
*
*
* It is also possible to set `bindToController` to an object hash with the same format as the `scope` property.
@@ -17628,7 +18322,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
var bindingCache = createMap();
function parseIsolateBindings(scope, directiveName, isController) {
- var LOCAL_REGEXP = /^\s*([@&<]|=(\*?))(\??)\s*(\w*)\s*$/;
+ var LOCAL_REGEXP = /^\s*([@&<]|=(\*?))(\??)\s*([\w$]*)\s*$/;
var bindings = createMap();
@@ -17786,7 +18480,8 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
* @ngdoc method
* @name $compileProvider#component
* @module ng
- * @param {string} name Name of the component in camelCase (i.e. `myComp` which will match `
`)
+ * @param {string|Object} name Name of the component in camelCase (i.e. `myComp` which will match ``),
+ * or an object map of components where the keys are the names and the values are the component definition objects.
* @param {Object} options Component definition object (a simplified
* {@link ng.$compile#directive-definition-object directive definition object}),
* with the following properties (all optional):
@@ -17869,6 +18564,11 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
* See also {@link ng.$compileProvider#directive $compileProvider.directive()}.
*/
this.component = function registerComponent(name, options) {
+ if (!isString(name)) {
+ forEach(name, reverseParams(bind(this, registerComponent)));
+ return this;
+ }
+
var controller = options.controller || function() {};
function factory($injector) {
@@ -18032,7 +18732,14 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
*
* If disabled (false), the compiler calls the constructor first before assigning bindings.
*
- * The default value is true in Angular 1.5.x but will switch to false in Angular 1.6.x.
+ * The default value is false.
+ *
+ * @deprecated
+ * sinceVersion="1.6.0"
+ * removeVersion="1.7.0"
+ *
+ * This method and the option to assign the bindings before calling the controller's constructor
+ * will be removed in v1.7.0.
*/
var preAssignBindingsEnabled = false;
this.preAssignBindingsEnabled = function(enabled) {
@@ -19797,10 +20504,10 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
}
linkQueue = null;
}).catch(function(error) {
- if (error instanceof Error) {
+ if (isError(error)) {
$exceptionHandler(error);
}
- }).catch(noop);
+ });
return function delayedNodeLinkFn(ignoreChildLinkFn, scope, node, rootElement, boundTranscludeFn) {
var childBoundTranscludeFn = boundTranscludeFn;
@@ -20122,8 +20829,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
if (parentGet.literal) {
compare = equals;
} else {
- // eslint-disable-next-line no-self-compare
- compare = function simpleCompare(a, b) { return a === b || (a !== a && b !== b); };
+ compare = simpleCompare;
}
parentSet = parentGet.assign || function() {
// reset the change, or we will throw this exception on every $digest
@@ -20198,9 +20904,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
});
function recordChanges(key, currentValue, previousValue) {
- if (isFunction(destination.$onChanges) && currentValue !== previousValue &&
- // eslint-disable-next-line no-self-compare
- (currentValue === currentValue || previousValue === previousValue)) {
+ if (isFunction(destination.$onChanges) && !simpleCompare(currentValue, previousValue)) {
// If we have not already scheduled the top level onChangesQueue handler then do so now
if (!onChangesQueue) {
scope.$$postDigest(flushOnChangesQueue);
@@ -20815,7 +21519,12 @@ function defaultHttpResponseTransform(data, headers) {
if (tempData) {
var contentType = headers('Content-Type');
if ((contentType && (contentType.indexOf(APPLICATION_JSON) === 0)) || isJsonLike(tempData)) {
- data = fromJson(tempData);
+ try {
+ data = fromJson(tempData);
+ } catch (e) {
+ throw $httpMinErr('baddata', 'Data must be a valid JSON object. Received: "{0}". ' +
+ 'Parse error: "{1}"', data, e);
+ }
}
}
}
@@ -20938,12 +21647,6 @@ function $HttpProvider() {
* {@link ng.$cacheFactory `$cacheFactory`} to enable or disable caching of HTTP responses
* by default. See {@link $http#caching $http Caching} for more information.
*
- * - **`defaults.xsrfCookieName`** - {string} - Name of cookie containing the XSRF token.
- * Defaults value is `'XSRF-TOKEN'`.
- *
- * - **`defaults.xsrfHeaderName`** - {string} - Name of HTTP header to populate with the
- * XSRF token. Defaults value is `'X-XSRF-TOKEN'`.
- *
* - **`defaults.headers`** - {Object} - Default headers for all $http requests.
* Refer to {@link ng.$http#setting-http-headers $http} for documentation on
* setting default headers.
@@ -20952,15 +21655,38 @@ function $HttpProvider() {
* - **`defaults.headers.put`**
* - **`defaults.headers.patch`**
*
+ * - **`defaults.jsonpCallbackParam`** - `{string}` - the name of the query parameter that passes the name of the
+ * callback in a JSONP request. The value of this parameter will be replaced with the expression generated by the
+ * {@link $jsonpCallbacks} service. Defaults to `'callback'`.
*
* - **`defaults.paramSerializer`** - `{string|function(Object):string}` - A function
* used to the prepare string representation of request parameters (specified as an object).
* If specified as string, it is interpreted as a function registered with the {@link auto.$injector $injector}.
* Defaults to {@link ng.$httpParamSerializer $httpParamSerializer}.
*
- * - **`defaults.jsonpCallbackParam`** - `{string}` - the name of the query parameter that passes the name of the
- * callback in a JSONP request. The value of this parameter will be replaced with the expression generated by the
- * {@link $jsonpCallbacks} service. Defaults to `'callback'`.
+ * - **`defaults.transformRequest`** -
+ * `{Array|function(data, headersGetter)}` -
+ * An array of functions (or a single function) which are applied to the request data.
+ * By default, this is an array with one request transformation function:
+ *
+ * - If the `data` property of the request configuration object contains an object, serialize it
+ * into JSON format.
+ *
+ * - **`defaults.transformResponse`** -
+ * `{Array|function(data, headersGetter, status)}` -
+ * An array of functions (or a single function) which are applied to the response data. By default,
+ * this is an array which applies one response transformation function that does two things:
+ *
+ * - If XSRF prefix is detected, strip it
+ * (see {@link ng.$http#security-considerations Security Considerations in the $http docs}).
+ * - If the `Content-Type` is `application/json` or the response looks like JSON,
+ * deserialize it using a JSON parser.
+ *
+ * - **`defaults.xsrfCookieName`** - {string} - Name of cookie containing the XSRF token.
+ * Defaults value is `'XSRF-TOKEN'`.
+ *
+ * - **`defaults.xsrfHeaderName`** - {string} - Name of HTTP header to populate with the
+ * XSRF token. Defaults value is `'X-XSRF-TOKEN'`.
*
**/
var defaults = this.defaults = {
@@ -21224,15 +21950,18 @@ function $HttpProvider() {
*
* Angular provides the following default transformations:
*
- * Request transformations (`$httpProvider.defaults.transformRequest` and `$http.defaults.transformRequest`):
+ * Request transformations (`$httpProvider.defaults.transformRequest` and `$http.defaults.transformRequest`) is
+ * an array with one function that does the following:
*
* - If the `data` property of the request configuration object contains an object, serialize it
* into JSON format.
*
- * Response transformations (`$httpProvider.defaults.transformResponse` and `$http.defaults.transformResponse`):
+ * Response transformations (`$httpProvider.defaults.transformResponse` and `$http.defaults.transformResponse`) is
+ * an array with one function that does the following:
*
* - If XSRF prefix is detected, strip it (see Security Considerations section below).
- * - If JSON response is detected, deserialize it using a JSON parser.
+ * - If the `Content-Type` is `application/json` or the response looks like JSON,
+ * deserialize it using a JSON parser.
*
*
* ### Overriding the Default Transformations Per Request
@@ -21932,7 +22661,8 @@ function $HttpProvider() {
if ((config.cache || defaults.cache) && config.cache !== false &&
(config.method === 'GET' || config.method === 'JSONP')) {
cache = isObject(config.cache) ? config.cache
- : isObject(defaults.cache) ? defaults.cache
+ : isObject(/** @type {?} */ (defaults).cache)
+ ? /** @type {?} */ (defaults).cache
: defaultCache;
}
@@ -22719,7 +23449,7 @@ function $IntervalProvider() {
* @param {boolean=} [invokeApply=true] If set to `false` skips model dirty checking, otherwise
* will invoke `fn` within the {@link ng.$rootScope.Scope#$apply $apply} block.
* @param {...*=} Pass additional parameters to the executed function.
- * @returns {promise} A promise which will be notified on each iteration.
+ * @returns {promise} A promise which will be notified on each iteration. It will resolve once all iterations of the interval complete.
*
* @example
*
@@ -22868,7 +23598,7 @@ function $IntervalProvider() {
interval.cancel = function(promise) {
if (promise && promise.$$intervalId in intervals) {
// Interval cancels should not report as unhandled promise.
- intervals[promise.$$intervalId].promise.catch(noop);
+ markQExceptionHandled(intervals[promise.$$intervalId].promise);
intervals[promise.$$intervalId].reject('canceled');
$window.clearInterval(promise.$$intervalId);
delete intervals[promise.$$intervalId];
@@ -22891,8 +23621,8 @@ function $IntervalProvider() {
* how they vary compared to the requested url.
*/
var $jsonpCallbacksProvider = /** @this */ function() {
- this.$get = ['$window', function($window) {
- var callbacks = $window.angular.callbacks;
+ this.$get = function() {
+ var callbacks = angular.callbacks;
var callbackMap = {};
function createCallback(callbackId) {
@@ -22959,7 +23689,7 @@ var $jsonpCallbacksProvider = /** @this */ function() {
delete callbackMap[callbackPath];
}
};
- }];
+ };
};
/**
@@ -23110,6 +23840,8 @@ function LocationHtml5Url(appBase, appBaseNoFile, basePrefix) {
this.$$url = encodePath(this.$$path) + (search ? '?' + search : '') + hash;
this.$$absUrl = appBaseNoFile + this.$$url.substr(1); // first char is always '/'
+
+ this.$$urlUpdatedByLocation = true;
};
this.$$parseLinkUrl = function(url, relHref) {
@@ -23187,7 +23919,7 @@ function LocationHashbangUrl(appBase, appBaseNoFile, hashPrefix) {
withoutHashUrl = '';
if (isUndefined(withoutBaseUrl)) {
appBase = url;
- this.replace();
+ /** @type {?} */ (this).replace();
}
}
}
@@ -23243,6 +23975,8 @@ function LocationHashbangUrl(appBase, appBaseNoFile, hashPrefix) {
this.$$url = encodePath(this.$$path) + (search ? '?' + search : '') + hash;
this.$$absUrl = appBase + (this.$$url ? hashPrefix + this.$$url : '');
+
+ this.$$urlUpdatedByLocation = true;
};
this.$$parseLinkUrl = function(url, relHref) {
@@ -23300,6 +24034,8 @@ function LocationHashbangInHtml5Url(appBase, appBaseNoFile, hashPrefix) {
this.$$url = encodePath(this.$$path) + (search ? '?' + search : '') + hash;
// include hashPrefix in $$absUrl when $$url is empty so IE9 does not reload page because of removal of '#'
this.$$absUrl = appBase + hashPrefix + this.$$url;
+
+ this.$$urlUpdatedByLocation = true;
};
}
@@ -23629,6 +24365,7 @@ forEach([LocationHashbangInHtml5Url, LocationHashbangUrl, LocationHtml5Url], fun
// but we're changing the $$state reference to $browser.state() during the $digest
// so the modification window is narrow.
this.$$state = isUndefined(state) ? null : state;
+ this.$$urlUpdatedByLocation = true;
return this;
};
@@ -23941,36 +24678,40 @@ function $LocationProvider() {
// update browser
$rootScope.$watch(function $locationWatch() {
- var oldUrl = trimEmptyHash($browser.url());
- var newUrl = trimEmptyHash($location.absUrl());
- var oldState = $browser.state();
- var currentReplace = $location.$$replace;
- var urlOrStateChanged = oldUrl !== newUrl ||
- ($location.$$html5 && $sniffer.history && oldState !== $location.$$state);
+ if (initializing || $location.$$urlUpdatedByLocation) {
+ $location.$$urlUpdatedByLocation = false;
- if (initializing || urlOrStateChanged) {
- initializing = false;
+ var oldUrl = trimEmptyHash($browser.url());
+ var newUrl = trimEmptyHash($location.absUrl());
+ var oldState = $browser.state();
+ var currentReplace = $location.$$replace;
+ var urlOrStateChanged = oldUrl !== newUrl ||
+ ($location.$$html5 && $sniffer.history && oldState !== $location.$$state);
- $rootScope.$evalAsync(function() {
- var newUrl = $location.absUrl();
- var defaultPrevented = $rootScope.$broadcast('$locationChangeStart', newUrl, oldUrl,
- $location.$$state, oldState).defaultPrevented;
+ if (initializing || urlOrStateChanged) {
+ initializing = false;
- // if the location was changed by a `$locationChangeStart` handler then stop
- // processing this location change
- if ($location.absUrl() !== newUrl) return;
+ $rootScope.$evalAsync(function() {
+ var newUrl = $location.absUrl();
+ var defaultPrevented = $rootScope.$broadcast('$locationChangeStart', newUrl, oldUrl,
+ $location.$$state, oldState).defaultPrevented;
- if (defaultPrevented) {
- $location.$$parse(oldUrl);
- $location.$$state = oldState;
- } else {
- if (urlOrStateChanged) {
- setBrowserUrlWithFallback(newUrl, currentReplace,
- oldState === $location.$$state ? null : $location.$$state);
+ // if the location was changed by a `$locationChangeStart` handler then stop
+ // processing this location change
+ if ($location.absUrl() !== newUrl) return;
+
+ if (defaultPrevented) {
+ $location.$$parse(oldUrl);
+ $location.$$state = oldState;
+ } else {
+ if (urlOrStateChanged) {
+ setBrowserUrlWithFallback(newUrl, currentReplace,
+ oldState === $location.$$state ? null : $location.$$state);
+ }
+ afterLocationChange(oldUrl, oldState);
}
- afterLocationChange(oldUrl, oldState);
- }
- });
+ });
+ }
}
$location.$$replace = false;
@@ -23999,6 +24740,14 @@ function $LocationProvider() {
*
* The main purpose of this service is to simplify debugging and troubleshooting.
*
+ * To reveal the location of the calls to `$log` in the JavaScript console,
+ * you can "blackbox" the AngularJS source in your browser:
+ *
+ * [Mozilla description of blackboxing](https://developer.mozilla.org/en-US/docs/Tools/Debugger/How_to/Black_box_a_source).
+ * [Chrome description of blackboxing](https://developer.chrome.com/devtools/docs/blackboxing).
+ *
+ * Note: Not all browsers support blackboxing.
+ *
* The default is to log `debug` messages. You can use
* {@link ng.$logProvider ng.$logProvider#debugEnabled} to change this.
*
@@ -24048,13 +24797,22 @@ function $LogProvider() {
this.debugEnabled = function(flag) {
if (isDefined(flag)) {
debug = flag;
- return this;
+ return this;
} else {
return debug;
}
};
this.$get = ['$window', function($window) {
+ // Support: IE 9-11, Edge 12-14+
+ // IE/Edge display errors in such a way that it requires the user to click in 4 places
+ // to see the stack trace. There is no way to feature-detect it so there's a chance
+ // of the user agent sniffing to go wrong but since it's only about logging, this shouldn't
+ // break apps. Other browsers display errors in a sensible way and some of them map stack
+ // traces along source maps if available so it makes sense to let browsers display it
+ // as they want.
+ var formatStackTrace = msie || /\bEdge\//.test($window.navigator && $window.navigator.userAgent);
+
return {
/**
* @ngdoc method
@@ -24111,8 +24869,8 @@ function $LogProvider() {
};
function formatError(arg) {
- if (arg instanceof Error) {
- if (arg.stack) {
+ if (isError(arg)) {
+ if (arg.stack && formatStackTrace) {
arg = (arg.message && arg.stack.indexOf(arg.message) === -1)
? 'Error: ' + arg.message + '\n' + arg.stack
: arg.stack;
@@ -24125,29 +24883,17 @@ function $LogProvider() {
function consoleLog(type) {
var console = $window.console || {},
- logFn = console[type] || console.log || noop,
- hasApply = false;
-
- // Note: reading logFn.apply throws an error in IE11 in IE8 document mode.
- // The reason behind this is that console.log has type "object" in IE8...
- try {
- hasApply = !!logFn.apply;
- } catch (e) { /* empty */ }
-
- if (hasApply) {
- return function() {
- var args = [];
- forEach(arguments, function(arg) {
- args.push(formatError(arg));
- });
- return logFn.apply(console, args);
- };
- }
+ logFn = console[type] || console.log || noop;
- // we are IE which either doesn't have window.console => this is noop and we do nothing,
- // or we are IE where console.log doesn't have apply so we log at least first 2 args
- return function(arg1, arg2) {
- logFn(arg1, arg2 == null ? '' : arg2);
+ return function() {
+ var args = [];
+ forEach(arguments, function(arg) {
+ args.push(formatError(arg));
+ });
+ // Support: IE 9 only
+ // console methods don't inherit from Function.prototype in IE 9 so we can't
+ // call `logFn.apply(console, args)` directly.
+ return Function.prototype.apply.call(logFn, console, args);
};
}
}];
@@ -24775,15 +25521,47 @@ function isStateless($filter, filterName) {
return !fn.$stateful;
}
-function findConstantAndWatchExpressions(ast, $filter) {
+var PURITY_ABSOLUTE = 1;
+var PURITY_RELATIVE = 2;
+
+// Detect nodes which could depend on non-shallow state of objects
+function isPure(node, parentIsPure) {
+ switch (node.type) {
+ // Computed members might invoke a stateful toString()
+ case AST.MemberExpression:
+ if (node.computed) {
+ return false;
+ }
+ break;
+
+ // Unary always convert to primative
+ case AST.UnaryExpression:
+ return PURITY_ABSOLUTE;
+
+ // The binary + operator can invoke a stateful toString().
+ case AST.BinaryExpression:
+ return node.operator !== '+' ? PURITY_ABSOLUTE : false;
+
+ // Functions / filters probably read state from within objects
+ case AST.CallExpression:
+ return false;
+ }
+
+ return (undefined === parentIsPure) ? PURITY_RELATIVE : parentIsPure;
+}
+
+function findConstantAndWatchExpressions(ast, $filter, parentIsPure) {
var allConstants;
var argsToWatch;
var isStatelessFilter;
+
+ var astIsPure = ast.isPure = isPure(ast, parentIsPure);
+
switch (ast.type) {
case AST.Program:
allConstants = true;
forEach(ast.body, function(expr) {
- findConstantAndWatchExpressions(expr.expression, $filter);
+ findConstantAndWatchExpressions(expr.expression, $filter, astIsPure);
allConstants = allConstants && expr.expression.constant;
});
ast.constant = allConstants;
@@ -24793,26 +25571,26 @@ function findConstantAndWatchExpressions(ast, $filter) {
ast.toWatch = [];
break;
case AST.UnaryExpression:
- findConstantAndWatchExpressions(ast.argument, $filter);
+ findConstantAndWatchExpressions(ast.argument, $filter, astIsPure);
ast.constant = ast.argument.constant;
ast.toWatch = ast.argument.toWatch;
break;
case AST.BinaryExpression:
- findConstantAndWatchExpressions(ast.left, $filter);
- findConstantAndWatchExpressions(ast.right, $filter);
+ findConstantAndWatchExpressions(ast.left, $filter, astIsPure);
+ findConstantAndWatchExpressions(ast.right, $filter, astIsPure);
ast.constant = ast.left.constant && ast.right.constant;
ast.toWatch = ast.left.toWatch.concat(ast.right.toWatch);
break;
case AST.LogicalExpression:
- findConstantAndWatchExpressions(ast.left, $filter);
- findConstantAndWatchExpressions(ast.right, $filter);
+ findConstantAndWatchExpressions(ast.left, $filter, astIsPure);
+ findConstantAndWatchExpressions(ast.right, $filter, astIsPure);
ast.constant = ast.left.constant && ast.right.constant;
ast.toWatch = ast.constant ? [] : [ast];
break;
case AST.ConditionalExpression:
- findConstantAndWatchExpressions(ast.test, $filter);
- findConstantAndWatchExpressions(ast.alternate, $filter);
- findConstantAndWatchExpressions(ast.consequent, $filter);
+ findConstantAndWatchExpressions(ast.test, $filter, astIsPure);
+ findConstantAndWatchExpressions(ast.alternate, $filter, astIsPure);
+ findConstantAndWatchExpressions(ast.consequent, $filter, astIsPure);
ast.constant = ast.test.constant && ast.alternate.constant && ast.consequent.constant;
ast.toWatch = ast.constant ? [] : [ast];
break;
@@ -24821,9 +25599,9 @@ function findConstantAndWatchExpressions(ast, $filter) {
ast.toWatch = [ast];
break;
case AST.MemberExpression:
- findConstantAndWatchExpressions(ast.object, $filter);
+ findConstantAndWatchExpressions(ast.object, $filter, astIsPure);
if (ast.computed) {
- findConstantAndWatchExpressions(ast.property, $filter);
+ findConstantAndWatchExpressions(ast.property, $filter, astIsPure);
}
ast.constant = ast.object.constant && (!ast.computed || ast.property.constant);
ast.toWatch = [ast];
@@ -24833,7 +25611,7 @@ function findConstantAndWatchExpressions(ast, $filter) {
allConstants = isStatelessFilter;
argsToWatch = [];
forEach(ast.arguments, function(expr) {
- findConstantAndWatchExpressions(expr, $filter);
+ findConstantAndWatchExpressions(expr, $filter, astIsPure);
allConstants = allConstants && expr.constant;
if (!expr.constant) {
argsToWatch.push.apply(argsToWatch, expr.toWatch);
@@ -24843,8 +25621,8 @@ function findConstantAndWatchExpressions(ast, $filter) {
ast.toWatch = isStatelessFilter ? argsToWatch : [ast];
break;
case AST.AssignmentExpression:
- findConstantAndWatchExpressions(ast.left, $filter);
- findConstantAndWatchExpressions(ast.right, $filter);
+ findConstantAndWatchExpressions(ast.left, $filter, astIsPure);
+ findConstantAndWatchExpressions(ast.right, $filter, astIsPure);
ast.constant = ast.left.constant && ast.right.constant;
ast.toWatch = [ast];
break;
@@ -24852,7 +25630,7 @@ function findConstantAndWatchExpressions(ast, $filter) {
allConstants = true;
argsToWatch = [];
forEach(ast.elements, function(expr) {
- findConstantAndWatchExpressions(expr, $filter);
+ findConstantAndWatchExpressions(expr, $filter, astIsPure);
allConstants = allConstants && expr.constant;
if (!expr.constant) {
argsToWatch.push.apply(argsToWatch, expr.toWatch);
@@ -24865,11 +25643,18 @@ function findConstantAndWatchExpressions(ast, $filter) {
allConstants = true;
argsToWatch = [];
forEach(ast.properties, function(property) {
- findConstantAndWatchExpressions(property.value, $filter);
+ findConstantAndWatchExpressions(property.value, $filter, astIsPure);
allConstants = allConstants && property.value.constant && !property.computed;
if (!property.value.constant) {
argsToWatch.push.apply(argsToWatch, property.value.toWatch);
}
+ if (property.computed) {
+ findConstantAndWatchExpressions(property.key, $filter, astIsPure);
+ if (!property.key.constant) {
+ argsToWatch.push.apply(argsToWatch, property.key.toWatch);
+ }
+ }
+
});
ast.constant = allConstants;
ast.toWatch = argsToWatch;
@@ -24915,15 +25700,13 @@ function isConstant(ast) {
return ast.constant;
}
-function ASTCompiler(astBuilder, $filter) {
- this.astBuilder = astBuilder;
+function ASTCompiler($filter) {
this.$filter = $filter;
}
ASTCompiler.prototype = {
- compile: function(expression) {
+ compile: function(ast) {
var self = this;
- var ast = this.astBuilder.ast(expression);
this.state = {
nextId: 0,
filters: {},
@@ -24951,7 +25734,7 @@ ASTCompiler.prototype = {
var intoId = self.nextId();
self.recurse(watch, intoId);
self.return_(intoId);
- self.state.inputs.push(fnKey);
+ self.state.inputs.push({name: fnKey, isPure: watch.isPure});
watch.watchId = key;
});
this.state.computing = 'fn';
@@ -24978,8 +25761,6 @@ ASTCompiler.prototype = {
ifDefined,
plusFn);
this.state = this.stage = undefined;
- fn.literal = isLiteral(ast);
- fn.constant = isConstant(ast);
return fn;
},
@@ -24989,13 +25770,16 @@ ASTCompiler.prototype = {
watchFns: function() {
var result = [];
- var fns = this.state.inputs;
+ var inputs = this.state.inputs;
var self = this;
- forEach(fns, function(name) {
- result.push('var ' + name + '=' + self.generateFunction(name, 's'));
+ forEach(inputs, function(input) {
+ result.push('var ' + input.name + '=' + self.generateFunction(input.name, 's'));
+ if (input.isPure) {
+ result.push(input.name, '.isPure=' + JSON.stringify(input.isPure) + ';');
+ }
});
- if (fns.length) {
- result.push('fn.inputs=[' + fns.join(',') + '];');
+ if (inputs.length) {
+ result.push('fn.inputs=[' + inputs.map(function(i) { return i.name; }).join(',') + '];');
}
return result.join('');
},
@@ -25382,15 +26166,13 @@ ASTCompiler.prototype = {
};
-function ASTInterpreter(astBuilder, $filter) {
- this.astBuilder = astBuilder;
+function ASTInterpreter($filter) {
this.$filter = $filter;
}
ASTInterpreter.prototype = {
- compile: function(expression) {
+ compile: function(ast) {
var self = this;
- var ast = this.astBuilder.ast(expression);
findConstantAndWatchExpressions(ast, self.$filter);
var assignable;
var assign;
@@ -25403,6 +26185,7 @@ ASTInterpreter.prototype = {
inputs = [];
forEach(toWatch, function(watch, key) {
var input = self.recurse(watch);
+ input.isPure = watch.isPure;
watch.input = input;
inputs.push(input);
watch.watchId = key;
@@ -25429,8 +26212,6 @@ ASTInterpreter.prototype = {
if (inputs) {
fn.inputs = inputs;
}
- fn.literal = isLiteral(ast);
- fn.constant = isConstant(ast);
return fn;
},
@@ -25759,20 +26540,21 @@ ASTInterpreter.prototype = {
/**
* @constructor
*/
-var Parser = function Parser(lexer, $filter, options) {
- this.lexer = lexer;
- this.$filter = $filter;
- this.options = options;
+function Parser(lexer, $filter, options) {
this.ast = new AST(lexer, options);
- this.astCompiler = options.csp ? new ASTInterpreter(this.ast, $filter) :
- new ASTCompiler(this.ast, $filter);
-};
+ this.astCompiler = options.csp ? new ASTInterpreter($filter) :
+ new ASTCompiler($filter);
+}
Parser.prototype = {
constructor: Parser,
parse: function(text) {
- return this.astCompiler.compile(text);
+ var ast = this.ast.ast(text);
+ var fn = this.astCompiler.compile(ast);
+ fn.literal = isLiteral(ast);
+ fn.constant = isConstant(ast);
+ return fn;
}
};
@@ -25935,7 +26717,7 @@ function $ParseProvider() {
}
}
- function expressionInputDirtyCheck(newValue, oldValueOfValue) {
+ function expressionInputDirtyCheck(newValue, oldValueOfValue, compareObjectIdentity) {
if (newValue == null || oldValueOfValue == null) { // null/undefined
return newValue === oldValueOfValue;
@@ -25948,7 +26730,7 @@ function $ParseProvider() {
// be cheaply dirty-checked
newValue = getValueOf(newValue);
- if (typeof newValue === 'object') {
+ if (typeof newValue === 'object' && !compareObjectIdentity) {
// objects/arrays are not supported - deep-watching them would be too expensive
return false;
}
@@ -25970,7 +26752,7 @@ function $ParseProvider() {
inputExpressions = inputExpressions[0];
return scope.$watch(function expressionInputWatch(scope) {
var newInputValue = inputExpressions(scope);
- if (!expressionInputDirtyCheck(newInputValue, oldInputValueOf)) {
+ if (!expressionInputDirtyCheck(newInputValue, oldInputValueOf, inputExpressions.isPure)) {
lastResult = parsedExpression(scope, undefined, undefined, [newInputValue]);
oldInputValueOf = newInputValue && getValueOf(newInputValue);
}
@@ -25990,7 +26772,7 @@ function $ParseProvider() {
for (var i = 0, ii = inputExpressions.length; i < ii; i++) {
var newInputValue = inputExpressions[i](scope);
- if (changed || (changed = !expressionInputDirtyCheck(newInputValue, oldInputValueOfValues[i]))) {
+ if (changed || (changed = !expressionInputDirtyCheck(newInputValue, oldInputValueOfValues[i], inputExpressions[i].isPure))) {
oldInputValues[i] = newInputValue;
oldInputValueOfValues[i] = newInputValue && getValueOf(newInputValue);
}
@@ -26088,17 +26870,26 @@ function $ParseProvider() {
// Propagate $$watchDelegates other then inputsWatchDelegate
useInputs = !parsedExpression.inputs;
- if (parsedExpression.$$watchDelegate &&
- parsedExpression.$$watchDelegate !== inputsWatchDelegate) {
- fn.$$watchDelegate = parsedExpression.$$watchDelegate;
+ if (watchDelegate && watchDelegate !== inputsWatchDelegate) {
+ fn.$$watchDelegate = watchDelegate;
fn.inputs = parsedExpression.inputs;
} else if (!interceptorFn.$stateful) {
- // If there is an interceptor, but no watchDelegate then treat the interceptor like
- // we treat filters - it is assumed to be a pure function unless flagged with $stateful
+ // Treat interceptor like filters - assume non-stateful by default and use the inputsWatchDelegate
fn.$$watchDelegate = inputsWatchDelegate;
fn.inputs = parsedExpression.inputs ? parsedExpression.inputs : [parsedExpression];
}
+ if (fn.inputs) {
+ fn.inputs = fn.inputs.map(function(e) {
+ // Remove the isPure flag of inputs when it is not absolute because they are now wrapped in a
+ // potentially non-pure interceptor function.
+ if (e.isPure === PURITY_RELATIVE) {
+ return function depurifier(s) { return e(s); };
+ }
+ return e;
+ });
+ }
+
return fn;
}
}];
@@ -26384,7 +27175,7 @@ function $$QProvider() {
* @param {function(function)} nextTick Function for executing functions in the next turn.
* @param {function(...*)} exceptionHandler Function into which unexpected exceptions are passed for
* debugging purposes.
- @ param {=boolean} errorOnUnhandledRejections Whether an error should be generated on unhandled
+ * @param {boolean=} errorOnUnhandledRejections Whether an error should be generated on unhandled
* promises rejections.
* @returns {object} Promise manager.
*/
@@ -26455,7 +27246,7 @@ function qFactory(nextTick, exceptionHandler, errorOnUnhandledRejections) {
state.pending = undefined;
try {
for (var i = 0, ii = pending.length; i < ii; ++i) {
- state.pur = true;
+ markQStateExceptionHandled(state);
promise = pending[i][0];
fn = pending[i][state.status];
try {
@@ -26482,10 +27273,10 @@ function qFactory(nextTick, exceptionHandler, errorOnUnhandledRejections) {
// eslint-disable-next-line no-unmodified-loop-condition
while (!queueSize && checkQueue.length) {
var toCheck = checkQueue.shift();
- if (!toCheck.pur) {
- toCheck.pur = true;
+ if (!isStateExceptionHandled(toCheck)) {
+ markQStateExceptionHandled(toCheck);
var errorMessage = 'Possibly unhandled rejection: ' + toDebugString(toCheck.value);
- if (toCheck.value instanceof Error) {
+ if (isError(toCheck.value)) {
exceptionHandler(toCheck.value, errorMessage);
} else {
exceptionHandler(errorMessage);
@@ -26495,7 +27286,7 @@ function qFactory(nextTick, exceptionHandler, errorOnUnhandledRejections) {
}
function scheduleProcessQueue(state) {
- if (errorOnUnhandledRejections && !state.pending && state.status === 2 && !state.pur) {
+ if (errorOnUnhandledRejections && !state.pending && state.status === 2 && !isStateExceptionHandled(state)) {
if (queueSize === 0 && checkQueue.length === 0) {
nextTick(processChecks);
}
@@ -26776,6 +27567,16 @@ function qFactory(nextTick, exceptionHandler, errorOnUnhandledRejections) {
return $Q;
}
+function isStateExceptionHandled(state) {
+ return !!state.pur;
+}
+function markQStateExceptionHandled(state) {
+ state.pur = true;
+}
+function markQExceptionHandled(q) {
+ markQStateExceptionHandled(q.$$state);
+}
+
/** @this */
function $$RAFProvider() { //rAF
this.$get = ['$window', '$timeout', function($window, $timeout) {
@@ -27256,6 +28057,12 @@ function $RootScopeProvider() {
* values are examined for changes on every call to `$digest`.
* - The `listener` is called whenever any expression in the `watchExpressions` array changes.
*
+ * `$watchGroup` is more performant than watching each expression individually, and should be
+ * used when the listener does not need to know which expression has changed.
+ * If the listener needs to know which expression has changed,
+ * {@link ng.$rootScope.Scope#$watch $watch()} or
+ * {@link ng.$rootScope.Scope#$watchCollection $watchCollection()} should be used.
+ *
* @param {Array.} watchExpressions Array of expressions that will be individually
* watched using {@link ng.$rootScope.Scope#$watch $watch()}
*
@@ -27264,7 +28071,34 @@ function $RootScopeProvider() {
* The `newValues` array contains the current values of the `watchExpressions`, with the indexes matching
* those of `watchExpression`
* and the `oldValues` array contains the previous values of the `watchExpressions`, with the indexes matching
- * those of `watchExpression`
+ * those of `watchExpression`.
+ *
+ * Note that `newValues` and `oldValues` reflect the differences in each **individual**
+ * expression, and not the difference of the values between each call of the listener.
+ * That means the difference between `newValues` and `oldValues` cannot be used to determine
+ * which expression has changed / remained stable:
+ *
+ * ```js
+ *
+ * $scope.$watchGroup(['v1', 'v2'], function(newValues, oldValues) {
+ * console.log(newValues, oldValues);
+ * });
+ *
+ * // newValues, oldValues initially
+ * // [undefined, undefined], [undefined, undefined]
+ *
+ * $scope.v1 = 'a';
+ * $scope.v2 = 'a';
+ *
+ * // ['a', 'a'], [undefined, undefined]
+ *
+ * $scope.v2 = 'b'
+ *
+ * // v1 hasn't changed since it became `'a'`, therefore its oldValue is still `undefined`
+ * // ['a', 'b'], [undefined, 'a']
+ *
+ * ```
+ *
* The `scope` refers to the current scope.
* @returns {function()} Returns a de-registration function for all listeners.
*/
@@ -27593,12 +28427,13 @@ function $RootScopeProvider() {
current = target;
// It's safe for asyncQueuePosition to be a local variable here because this loop can't
- // be reentered recursively. Calling $digest from a function passed to $applyAsync would
+ // be reentered recursively. Calling $digest from a function passed to $evalAsync would
// lead to a '$digest already in progress' error.
for (var asyncQueuePosition = 0; asyncQueuePosition < asyncQueue.length; asyncQueuePosition++) {
try {
asyncTask = asyncQueue[asyncQueuePosition];
- asyncTask.scope.$eval(asyncTask.expression, asyncTask.locals);
+ fn = asyncTask.fn;
+ fn(asyncTask.scope, asyncTask.locals);
} catch (e) {
$exceptionHandler(e);
}
@@ -27683,6 +28518,10 @@ function $RootScopeProvider() {
}
}
postDigestQueue.length = postDigestQueuePosition = 0;
+
+ // Check for changes to browser url that happened during the $digest
+ // (for which no event is fired; e.g. via `history.pushState()`)
+ $browser.$$checkUrlChange();
},
@@ -27828,7 +28667,7 @@ function $RootScopeProvider() {
});
}
- asyncQueue.push({scope: this, expression: $parse(expr), locals: locals});
+ asyncQueue.push({scope: this, fn: $parse(expr), locals: locals});
},
$$postDigest: function(fn) {
@@ -28302,12 +29141,21 @@ function $$SanitizeUriProvider() {
var $sceMinErr = minErr('$sce');
var SCE_CONTEXTS = {
+ // HTML is used when there's HTML rendered (e.g. ng-bind-html, iframe srcdoc binding).
HTML: 'html',
+
+ // Style statements or stylesheets. Currently unused in AngularJS.
CSS: 'css',
+
+ // An URL used in a context where it does not refer to a resource that loads code. Currently
+ // unused in AngularJS.
URL: 'url',
- // RESOURCE_URL is a subtype of URL used in contexts where a privileged resource is sourced from a
- // url. (e.g. ng-include, script src, templateUrl)
+
+ // RESOURCE_URL is a subtype of URL used where the referred-to resource could be interpreted as
+ // code. (e.g. ng-include, script src binding, templateUrl)
RESOURCE_URL: 'resourceUrl',
+
+ // Script. Currently unused in AngularJS.
JS: 'js'
};
@@ -28369,6 +29217,16 @@ function adjustMatchers(matchers) {
* `$sceDelegate` is a service that is used by the `$sce` service to provide {@link ng.$sce Strict
* Contextual Escaping (SCE)} services to AngularJS.
*
+ * For an overview of this service and the functionnality it provides in AngularJS, see the main
+ * page for {@link ng.$sce SCE}. The current page is targeted for developers who need to alter how
+ * SCE works in their application, which shouldn't be needed in most cases.
+ *
+ *
+ * AngularJS strongly relies on contextual escaping for the security of bindings: disabling or
+ * modifying this might cause cross site scripting (XSS) vulnerabilities. For libraries owners,
+ * changes to this service will also influence users, so be extra careful and document your changes.
+ *
+ *
* Typically, you would configure or override the {@link ng.$sceDelegate $sceDelegate} instead of
* the `$sce` service to customize the way Strict Contextual Escaping works in AngularJS. This is
* because, while the `$sce` provides numerous shorthand methods, etc., you really only need to
@@ -28394,10 +29252,14 @@ function adjustMatchers(matchers) {
* @description
*
* The `$sceDelegateProvider` provider allows developers to configure the {@link ng.$sceDelegate
- * $sceDelegate} service. This allows one to get/set the whitelists and blacklists used to ensure
- * that the URLs used for sourcing Angular templates are safe. Refer {@link
- * ng.$sceDelegateProvider#resourceUrlWhitelist $sceDelegateProvider.resourceUrlWhitelist} and
- * {@link ng.$sceDelegateProvider#resourceUrlBlacklist $sceDelegateProvider.resourceUrlBlacklist}
+ * $sceDelegate service}, used as a delegate for {@link ng.$sce Strict Contextual Escaping (SCE)}.
+ *
+ * The `$sceDelegateProvider` allows one to get/set the whitelists and blacklists used to ensure
+ * that the URLs used for sourcing AngularJS templates and other script-running URLs are safe (all
+ * places that use the `$sce.RESOURCE_URL` context). See
+ * {@link ng.$sceDelegateProvider#resourceUrlWhitelist $sceDelegateProvider.resourceUrlWhitelist}
+ * and
+ * {@link ng.$sceDelegateProvider#resourceUrlBlacklist $sceDelegateProvider.resourceUrlBlacklist},
*
* For the general details about this service in Angular, read the main page for {@link ng.$sce
* Strict Contextual Escaping (SCE)}.
@@ -28426,6 +29288,13 @@ function adjustMatchers(matchers) {
* ]);
* });
* ```
+ * Note that an empty whitelist will block every resource URL from being loaded, and will require
+ * you to manually mark each one as trusted with `$sce.trustAsResourceUrl`. However, templates
+ * requested by {@link ng.$templateRequest $templateRequest} that are present in
+ * {@link ng.$templateCache $templateCache} will not go through this check. If you have a mechanism
+ * to populate your templates in that cache at config time, then it is a good idea to remove 'self'
+ * from that whitelist. This helps to mitigate the security impact of certain types of issues, like
+ * for instance attacker-controlled `ng-includes`.
*/
function $SceDelegateProvider() {
@@ -28441,23 +29310,23 @@ function $SceDelegateProvider() {
* @kind function
*
* @param {Array=} whitelist When provided, replaces the resourceUrlWhitelist with the value
- * provided. This must be an array or null. A snapshot of this array is used so further
- * changes to the array are ignored.
- *
- * Follow {@link ng.$sce#resourceUrlPatternItem this link} for a description of the items
- * allowed in this array.
+ * provided. This must be an array or null. A snapshot of this array is used so further
+ * changes to the array are ignored.
+ * Follow {@link ng.$sce#resourceUrlPatternItem this link} for a description of the items
+ * allowed in this array.
*
- *
- * **Note:** an empty whitelist array will block all URLs!
- *
+ * @return {Array} The currently set whitelist array.
*
- * @return {Array} the currently set whitelist array.
+ * @description
+ * Sets/Gets the whitelist of trusted resource URLs.
*
* The **default value** when no whitelist has been explicitly set is `['self']` allowing only
* same origin resource requests.
*
- * @description
- * Sets/Gets the whitelist of trusted resource URLs.
+ *
+ * **Note:** the default whitelist of 'self' is not recommended if your app shares its origin
+ * with other apps! It is a good idea to limit it to only your application's directory.
+ *
*/
this.resourceUrlWhitelist = function(value) {
if (arguments.length) {
@@ -28472,25 +29341,23 @@ function $SceDelegateProvider() {
* @kind function
*
* @param {Array=} blacklist When provided, replaces the resourceUrlBlacklist with the value
- * provided. This must be an array or null. A snapshot of this array is used so further
- * changes to the array are ignored.
- *
- * Follow {@link ng.$sce#resourceUrlPatternItem this link} for a description of the items
- * allowed in this array.
+ * provided. This must be an array or null. A snapshot of this array is used so further
+ * changes to the array are ignored.
+ * Follow {@link ng.$sce#resourceUrlPatternItem this link} for a description of the items
+ * allowed in this array.
+ * The typical usage for the blacklist is to **block
+ * [open redirects](http://cwe.mitre.org/data/definitions/601.html)** served by your domain as
+ * these would otherwise be trusted but actually return content from the redirected domain.
+ *
+ * Finally, **the blacklist overrides the whitelist** and has the final say.
*
- * The typical usage for the blacklist is to **block
- * [open redirects](http://cwe.mitre.org/data/definitions/601.html)** served by your domain as
- * these would otherwise be trusted but actually return content from the redirected domain.
+ * @return {Array} The currently set blacklist array.
*
- * Finally, **the blacklist overrides the whitelist** and has the final say.
- *
- * @return {Array} the currently set blacklist array.
+ * @description
+ * Sets/Gets the blacklist of trusted resource URLs.
*
* The **default value** when no whitelist has been explicitly set is the empty array (i.e. there
* is no blacklist.)
- *
- * @description
- * Sets/Gets the blacklist of trusted resource URLs.
*/
this.resourceUrlBlacklist = function(value) {
@@ -28574,17 +29441,24 @@ function $SceDelegateProvider() {
* @name $sceDelegate#trustAs
*
* @description
- * Returns an object that is trusted by angular for use in specified strict
- * contextual escaping contexts (such as ng-bind-html, ng-include, any src
- * attribute interpolation, any dom event binding attribute interpolation
- * such as for onclick, etc.) that uses the provided value.
- * See {@link ng.$sce $sce} for enabling strict contextual escaping.
+ * Returns a trusted representation of the parameter for the specified context. This trusted
+ * object will later on be used as-is, without any security check, by bindings or directives
+ * that require this security context.
+ * For instance, marking a string as trusted for the `$sce.HTML` context will entirely bypass
+ * the potential `$sanitize` call in corresponding `$sce.HTML` bindings or directives, such as
+ * `ng-bind-html`. Note that in most cases you won't need to call this function: if you have the
+ * sanitizer loaded, passing the value itself will render all the HTML that does not pose a
+ * security risk.
*
- * @param {string} type The kind of context in which this value is safe for use. e.g. url,
- * resourceUrl, html, js and css.
- * @param {*} value The value that that should be considered trusted/safe.
- * @returns {*} A value that can be used to stand in for the provided `value` in places
- * where Angular expects a $sce.trustAs() return value.
+ * See {@link ng.$sceDelegate#getTrusted getTrusted} for the function that will consume those
+ * trusted values, and {@link ng.$sce $sce} for general documentation about strict contextual
+ * escaping.
+ *
+ * @param {string} type The context in which this value is safe for use, e.g. `$sce.URL`,
+ * `$sce.RESOURCE_URL`, `$sce.HTML`, `$sce.JS` or `$sce.CSS`.
+ *
+ * @param {*} value The value that should be considered trusted.
+ * @return {*} A trusted representation of value, that can be used in the given context.
*/
function trustAs(type, trustedValue) {
var Constructor = (byType.hasOwnProperty(type) ? byType[type] : null);
@@ -28616,11 +29490,11 @@ function $SceDelegateProvider() {
* ng.$sceDelegate#trustAs `$sceDelegate.trustAs`}.
*
* If the passed parameter is not a value that had been returned by {@link
- * ng.$sceDelegate#trustAs `$sceDelegate.trustAs`}, returns it as-is.
+ * ng.$sceDelegate#trustAs `$sceDelegate.trustAs`}, it must be returned as-is.
*
* @param {*} value The result of a prior {@link ng.$sceDelegate#trustAs `$sceDelegate.trustAs`}
- * call or anything else.
- * @returns {*} The `value` that was originally provided to {@link ng.$sceDelegate#trustAs
+ * call or anything else.
+ * @return {*} The `value` that was originally provided to {@link ng.$sceDelegate#trustAs
* `$sceDelegate.trustAs`} if `value` is the result of such a call. Otherwise, returns
* `value` unchanged.
*/
@@ -28637,33 +29511,38 @@ function $SceDelegateProvider() {
* @name $sceDelegate#getTrusted
*
* @description
- * Takes the result of a {@link ng.$sceDelegate#trustAs `$sceDelegate.trustAs`} call and
- * returns the originally supplied value if the queried context type is a supertype of the
- * created type. If this condition isn't satisfied, throws an exception.
+ * Takes any input, and either returns a value that's safe to use in the specified context, or
+ * throws an exception.
*
- *
- * Disabling auto-escaping is extremely dangerous, it usually creates a Cross Site Scripting
- * (XSS) vulnerability in your application.
- *
+ * In practice, there are several cases. When given a string, this function runs checks
+ * and sanitization to make it safe without prior assumptions. When given the result of a {@link
+ * ng.$sceDelegate#trustAs `$sceDelegate.trustAs`} call, it returns the originally supplied
+ * value if that value's context is valid for this call's context. Finally, this function can
+ * also throw when there is no way to turn `maybeTrusted` in a safe value (e.g., no sanitization
+ * is available or possible.)
*
- * @param {string} type The kind of context in which this value is to be used.
+ * @param {string} type The context in which this value is to be used (such as `$sce.HTML`).
* @param {*} maybeTrusted The result of a prior {@link ng.$sceDelegate#trustAs
- * `$sceDelegate.trustAs`} call.
- * @returns {*} The value the was originally provided to {@link ng.$sceDelegate#trustAs
- * `$sceDelegate.trustAs`} if valid in this context. Otherwise, throws an exception.
+ * `$sceDelegate.trustAs`} call, or anything else (which will not be considered trusted.)
+ * @return {*} A version of the value that's safe to use in the given context, or throws an
+ * exception if this is impossible.
*/
function getTrusted(type, maybeTrusted) {
if (maybeTrusted === null || isUndefined(maybeTrusted) || maybeTrusted === '') {
return maybeTrusted;
}
var constructor = (byType.hasOwnProperty(type) ? byType[type] : null);
+ // If maybeTrusted is a trusted class instance or subclass instance, then unwrap and return
+ // as-is.
if (constructor && maybeTrusted instanceof constructor) {
return maybeTrusted.$$unwrapTrustedValue();
}
- // If we get here, then we may only take one of two actions.
- // 1. sanitize the value for the requested type, or
- // 2. throw an exception.
+ // Otherwise, if we get here, then we may either make it safe, or throw an exception. This
+ // depends on the context: some are sanitizatible (HTML), some use whitelists (RESOURCE_URL),
+ // some are impossible to do (JS). This step isn't implemented for CSS and URL, as AngularJS
+ // has no corresponding sinks.
if (type === SCE_CONTEXTS.RESOURCE_URL) {
+ // RESOURCE_URL uses a whitelist.
if (isResourceUrlAllowedByPolicy(maybeTrusted)) {
return maybeTrusted;
} else {
@@ -28672,8 +29551,10 @@ function $SceDelegateProvider() {
maybeTrusted.toString());
}
} else if (type === SCE_CONTEXTS.HTML) {
+ // htmlSanitizer throws its own error when no sanitizer is available.
return htmlSanitizer(maybeTrusted);
}
+ // Default error when the $sce service has no way to make the input safe.
throw $sceMinErr('unsafe', 'Attempting to use an unsafe value in a safe context.');
}
@@ -28709,21 +29590,27 @@ function $SceDelegateProvider() {
*
* # Strict Contextual Escaping
*
- * Strict Contextual Escaping (SCE) is a mode in which AngularJS requires bindings in certain
- * contexts to result in a value that is marked as safe to use for that context. One example of
- * such a context is binding arbitrary html controlled by the user via `ng-bind-html`. We refer
- * to these contexts as privileged or SCE contexts.
+ * Strict Contextual Escaping (SCE) is a mode in which AngularJS constrains bindings to only render
+ * trusted values. Its goal is to assist in writing code in a way that (a) is secure by default, and
+ * (b) makes auditing for security vulnerabilities such as XSS, clickjacking, etc. a lot easier.
+ *
+ * ## Overview
*
- * As of version 1.2, Angular ships with SCE enabled by default.
+ * To systematically block XSS security bugs, AngularJS treats all values as untrusted by default in
+ * HTML or sensitive URL bindings. When binding untrusted values, AngularJS will automatically
+ * run security checks on them (sanitizations, whitelists, depending on context), or throw when it
+ * cannot guarantee the security of the result. That behavior depends strongly on contexts: HTML
+ * can be sanitized, but template URLs cannot, for instance.
*
- * Note: When enabled (the default), IE<11 in quirks mode is not supported. In this mode, IE<11 allow
- * one to execute arbitrary javascript by the use of the expression() syntax. Refer
- * to learn more about them.
- * You can ensure your document is in standards mode and not quirks mode by adding ``
- * to the top of your HTML document.
+ * To illustrate this, consider the `ng-bind-html` directive. It renders its value directly as HTML:
+ * we call that the *context*. When given an untrusted input, AngularJS will attempt to sanitize it
+ * before rendering if a sanitizer is available, and throw otherwise. To bypass sanitization and
+ * render the input as-is, you will need to mark it as trusted for that context before attempting
+ * to bind it.
*
- * SCE assists in writing code in a way that (a) is secure by default and (b) makes auditing for
- * security vulnerabilities such as XSS, clickjacking, etc. a lot easier.
+ * As of version 1.2, AngularJS ships with SCE enabled by default.
+ *
+ * ## In practice
*
* Here's an example of a binding in a privileged context:
*
@@ -28733,10 +29620,10 @@ function $SceDelegateProvider() {
* ```
*
* Notice that `ng-bind-html` is bound to `userHtml` controlled by the user. With SCE
- * disabled, this application allows the user to render arbitrary HTML into the DIV.
- * In a more realistic example, one may be rendering user comments, blog articles, etc. via
- * bindings. (HTML is just one example of a context where rendering user controlled input creates
- * security vulnerabilities.)
+ * disabled, this application allows the user to render arbitrary HTML into the DIV, which would
+ * be an XSS security bug. In a more realistic example, one may be rendering user comments, blog
+ * articles, etc. via bindings. (HTML is just one example of a context where rendering user
+ * controlled input creates security vulnerabilities.)
*
* For the case of HTML, you might use a library, either on the client side, or on the server side,
* to sanitize unsafe HTML before binding to the value and rendering it in the document.
@@ -28746,25 +29633,29 @@ function $SceDelegateProvider() {
* ensure that you didn't accidentally delete the line that sanitized the value, or renamed some
* properties/fields and forgot to update the binding to the sanitized value?
*
- * To be secure by default, you want to ensure that any such bindings are disallowed unless you can
- * determine that something explicitly says it's safe to use a value for binding in that
- * context. You can then audit your code (a simple grep would do) to ensure that this is only done
- * for those values that you can easily tell are safe - because they were received from your server,
- * sanitized by your library, etc. You can organize your codebase to help with this - perhaps
- * allowing only the files in a specific directory to do this. Ensuring that the internal API
- * exposed by that code doesn't markup arbitrary values as safe then becomes a more manageable task.
+ * To be secure by default, AngularJS makes sure bindings go through that sanitization, or
+ * any similar validation process, unless there's a good reason to trust the given value in this
+ * context. That trust is formalized with a function call. This means that as a developer, you
+ * can assume all untrusted bindings are safe. Then, to audit your code for binding security issues,
+ * you just need to ensure the values you mark as trusted indeed are safe - because they were
+ * received from your server, sanitized by your library, etc. You can organize your codebase to
+ * help with this - perhaps allowing only the files in a specific directory to do this.
+ * Ensuring that the internal API exposed by that code doesn't markup arbitrary values as safe then
+ * becomes a more manageable task.
*
* In the case of AngularJS' SCE service, one uses {@link ng.$sce#trustAs $sce.trustAs}
* (and shorthand methods such as {@link ng.$sce#trustAsHtml $sce.trustAsHtml}, etc.) to
- * obtain values that will be accepted by SCE / privileged contexts.
- *
+ * build the trusted versions of your values.
*
* ## How does it work?
*
* In privileged contexts, directives and code will bind to the result of {@link ng.$sce#getTrusted
- * $sce.getTrusted(context, value)} rather than to the value directly. Directives use {@link
- * ng.$sce#parseAs $sce.parseAs} rather than `$parse` to watch attribute bindings, which performs the
- * {@link ng.$sce#getTrusted $sce.getTrusted} behind the scenes on non-constant literals.
+ * $sce.getTrusted(context, value)} rather than to the value directly. Think of this function as
+ * a way to enforce the required security context in your data sink. Directives use {@link
+ * ng.$sce#parseAs $sce.parseAs} rather than `$parse` to watch attribute bindings, which performs
+ * the {@link ng.$sce#getTrusted $sce.getTrusted} behind the scenes on non-constant literals. Also,
+ * when binding without directives, AngularJS will understand the context of your bindings
+ * automatically.
*
* As an example, {@link ng.directive:ngBindHtml ngBindHtml} uses {@link
* ng.$sce#parseAsHtml $sce.parseAsHtml(binding expression)}. Here's the actual code (slightly
@@ -28805,11 +29696,12 @@ function $SceDelegateProvider() {
* It's important to remember that SCE only applies to interpolation expressions.
*
* If your expressions are constant literals, they're automatically trusted and you don't need to
- * call `$sce.trustAs` on them (remember to include the `ngSanitize` module) (e.g.
- * ``) just works.
- *
- * Additionally, `a[href]` and `img[src]` automatically sanitize their URLs and do not pass them
- * through {@link ng.$sce#getTrusted $sce.getTrusted}. SCE doesn't play a role here.
+ * call `$sce.trustAs` on them (e.g.
+ * ``) just works. The `$sceDelegate` will
+ * also use the `$sanitize` service if it is available when binding untrusted values to
+ * `$sce.HTML` context. AngularJS provides an implementation in `angular-sanitize.js`, and if you
+ * wish to use it, you will also need to depend on the {@link ngSanitize `ngSanitize`} module in
+ * your application.
*
* The included {@link ng.$sceDelegate $sceDelegate} comes with sane defaults to allow you to load
* templates in `ng-include` from your application's domain without having to even know about SCE.
@@ -28827,11 +29719,17 @@ function $SceDelegateProvider() {
*
* | Context | Notes |
* |---------------------|----------------|
- * | `$sce.HTML` | For HTML that's safe to source into the application. The {@link ng.directive:ngBindHtml ngBindHtml} directive uses this context for bindings. If an unsafe value is encountered and the {@link ngSanitize $sanitize} module is present this will sanitize the value instead of throwing an error. |
- * | `$sce.CSS` | For CSS that's safe to source into the application. Currently unused. Feel free to use it in your own directives. |
- * | `$sce.URL` | For URLs that are safe to follow as links. Currently unused (`
Note that `$sce.RESOURCE_URL` makes a stronger statement about the URL than `$sce.URL` does and therefore contexts requiring values trusted for `$sce.RESOURCE_URL` can be used anywhere that values trusted for `$sce.URL` are required. |
- * | `$sce.JS` | For JavaScript that is safe to execute in your application's context. Currently unused. Feel free to use it in your own directives. |
+ * | `$sce.HTML` | For HTML that's safe to source into the application. The {@link ng.directive:ngBindHtml ngBindHtml} directive uses this context for bindings. If an unsafe value is encountered, and the {@link ngSanitize.$sanitize $sanitize} service is available (implemented by the {@link ngSanitize ngSanitize} module) this will sanitize the value instead of throwing an error. |
+ * | `$sce.CSS` | For CSS that's safe to source into the application. Currently, no bindings require this context. Feel free to use it in your own directives. |
+ * | `$sce.URL` | For URLs that are safe to follow as links. Currently unused (`
Note that `$sce.RESOURCE_URL` makes a stronger statement about the URL than `$sce.URL` does (it's not just the URL that matters, but also what is at the end of it), and therefore contexts requiring values trusted for `$sce.RESOURCE_URL` can be used anywhere that values trusted for `$sce.URL` are required. |
+ * | `$sce.JS` | For JavaScript that is safe to execute in your application's context. Currently, no bindings require this context. Feel free to use it in your own directives. |
+ *
+ *
+ * Be aware that `a[href]` and `img[src]` automatically sanitize their URLs and do not pass them
+ * through {@link ng.$sce#getTrusted $sce.getTrusted}. There's no CSS-, URL-, or JS-context bindings
+ * in AngularJS currently, so their corresponding `$sce.trustAs` functions aren't useful yet. This
+ * might evolve.
*
* ## Format of items in {@link ng.$sceDelegateProvider#resourceUrlWhitelist resourceUrlWhitelist}/{@link ng.$sceDelegateProvider#resourceUrlBlacklist Blacklist}
*
@@ -28950,14 +29848,15 @@ function $SceDelegateProvider() {
* for little coding overhead. It will be much harder to take an SCE disabled application and
* either secure it on your own or enable SCE at a later stage. It might make sense to disable SCE
* for cases where you have a lot of existing code that was written before SCE was introduced and
- * you're migrating them a module at a time.
+ * you're migrating them a module at a time. Also do note that this is an app-wide setting, so if
+ * you are writing a library, you will cause security bugs applications using it.
*
* That said, here's how you can completely disable SCE:
*
* ```
* angular.module('myAppWithSceDisabledmyApp', []).config(function($sceProvider) {
* // Completely disable SCE. For demonstration purposes only!
- * // Do not use in new projects.
+ * // Do not use in new projects or libraries.
* $sceProvider.enabled(false);
* });
* ```
@@ -28972,8 +29871,8 @@ function $SceProvider() {
* @name $sceProvider#enabled
* @kind function
*
- * @param {boolean=} value If provided, then enables/disables SCE.
- * @return {boolean} true if SCE is enabled, false otherwise.
+ * @param {boolean=} value If provided, then enables/disables SCE application-wide.
+ * @return {boolean} True if SCE is enabled, false otherwise.
*
* @description
* Enables/disables SCE and returns the current value.
@@ -29027,9 +29926,9 @@ function $SceProvider() {
* getTrusted($sce.RESOURCE_URL, value) succeeding implies that getTrusted($sce.URL, value)
* will also succeed.
*
- * Inheritance happens to capture this in a natural way. In some future, we
- * may not use inheritance anymore. That is OK because no code outside of
- * sce.js and sceSpecs.js would need to be aware of this detail.
+ * Inheritance happens to capture this in a natural way. In some future, we may not use
+ * inheritance anymore. That is OK because no code outside of sce.js and sceSpecs.js would need to
+ * be aware of this detail.
*/
this.$get = ['$parse', '$sceDelegate', function(
@@ -29051,8 +29950,8 @@ function $SceProvider() {
* @name $sce#isEnabled
* @kind function
*
- * @return {Boolean} true if SCE is enabled, false otherwise. If you want to set the value, you
- * have to do it at module config time on {@link ng.$sceProvider $sceProvider}.
+ * @return {Boolean} True if SCE is enabled, false otherwise. If you want to set the value, you
+ * have to do it at module config time on {@link ng.$sceProvider $sceProvider}.
*
* @description
* Returns a boolean indicating if SCE is enabled.
@@ -29079,14 +29978,14 @@ function $SceProvider() {
* wraps the expression in a call to {@link ng.$sce#getTrusted $sce.getTrusted(*type*,
* *result*)}
*
- * @param {string} type The kind of SCE context in which this result will be used.
+ * @param {string} type The SCE context in which this result will be used.
* @param {string} expression String expression to compile.
- * @returns {function(context, locals)} a function which represents the compiled expression:
+ * @return {function(context, locals)} A function which represents the compiled expression:
*
- * * `context` – `{object}` – an object against which any expressions embedded in the strings
- * are evaluated against (typically a scope object).
- * * `locals` – `{object=}` – local variables context object, useful for overriding values in
- * `context`.
+ * * `context` – `{object}` – an object against which any expressions embedded in the
+ * strings are evaluated against (typically a scope object).
+ * * `locals` – `{object=}` – local variables context object, useful for overriding values
+ * in `context`.
*/
sce.parseAs = function sceParseAs(type, expr) {
var parsed = $parse(expr);
@@ -29104,18 +30003,18 @@ function $SceProvider() {
* @name $sce#trustAs
*
* @description
- * Delegates to {@link ng.$sceDelegate#trustAs `$sceDelegate.trustAs`}. As such,
- * returns an object that is trusted by angular for use in specified strict contextual
- * escaping contexts (such as ng-bind-html, ng-include, any src attribute
- * interpolation, any dom event binding attribute interpolation such as for onclick, etc.)
- * that uses the provided value. See * {@link ng.$sce $sce} for enabling strict contextual
- * escaping.
+ * Delegates to {@link ng.$sceDelegate#trustAs `$sceDelegate.trustAs`}. As such, returns a
+ * wrapped object that represents your value, and the trust you have in its safety for the given
+ * context. AngularJS can then use that value as-is in bindings of the specified secure context.
+ * This is used in bindings for `ng-bind-html`, `ng-include`, and most `src` attribute
+ * interpolations. See {@link ng.$sce $sce} for strict contextual escaping.
*
- * @param {string} type The kind of context in which this value is safe for use. e.g. url,
- * resourceUrl, html, js and css.
- * @param {*} value The value that that should be considered trusted/safe.
- * @returns {*} A value that can be used to stand in for the provided `value` in places
- * where Angular expects a $sce.trustAs() return value.
+ * @param {string} type The context in which this value is safe for use, e.g. `$sce.URL`,
+ * `$sce.RESOURCE_URL`, `$sce.HTML`, `$sce.JS` or `$sce.CSS`.
+ *
+ * @param {*} value The value that that should be considered trusted.
+ * @return {*} A wrapped version of value that can be used as a trusted variant of your `value`
+ * in the context you specified.
*/
/**
@@ -29126,11 +30025,23 @@ function $SceProvider() {
* Shorthand method. `$sce.trustAsHtml(value)` →
* {@link ng.$sceDelegate#trustAs `$sceDelegate.trustAs($sce.HTML, value)`}
*
- * @param {*} value The value to trustAs.
- * @returns {*} An object that can be passed to {@link ng.$sce#getTrustedHtml
- * $sce.getTrustedHtml(value)} to obtain the original value. (privileged directives
- * only accept expressions that are either literal constants or are the
- * return value of {@link ng.$sce#trustAs $sce.trustAs}.)
+ * @param {*} value The value to mark as trusted for `$sce.HTML` context.
+ * @return {*} A wrapped version of value that can be used as a trusted variant of your `value`
+ * in `$sce.HTML` context (like `ng-bind-html`).
+ */
+
+ /**
+ * @ngdoc method
+ * @name $sce#trustAsCss
+ *
+ * @description
+ * Shorthand method. `$sce.trustAsCss(value)` →
+ * {@link ng.$sceDelegate#trustAs `$sceDelegate.trustAs($sce.CSS, value)`}
+ *
+ * @param {*} value The value to mark as trusted for `$sce.CSS` context.
+ * @return {*} A wrapped version of value that can be used as a trusted variant
+ * of your `value` in `$sce.CSS` context. This context is currently unused, so there are
+ * almost no reasons to use this function so far.
*/
/**
@@ -29141,11 +30052,10 @@ function $SceProvider() {
* Shorthand method. `$sce.trustAsUrl(value)` →
* {@link ng.$sceDelegate#trustAs `$sceDelegate.trustAs($sce.URL, value)`}
*
- * @param {*} value The value to trustAs.
- * @returns {*} An object that can be passed to {@link ng.$sce#getTrustedUrl
- * $sce.getTrustedUrl(value)} to obtain the original value. (privileged directives
- * only accept expressions that are either literal constants or are the
- * return value of {@link ng.$sce#trustAs $sce.trustAs}.)
+ * @param {*} value The value to mark as trusted for `$sce.URL` context.
+ * @return {*} A wrapped version of value that can be used as a trusted variant of your `value`
+ * in `$sce.URL` context. That context is currently unused, so there are almost no reasons
+ * to use this function so far.
*/
/**
@@ -29156,11 +30066,10 @@ function $SceProvider() {
* Shorthand method. `$sce.trustAsResourceUrl(value)` →
* {@link ng.$sceDelegate#trustAs `$sceDelegate.trustAs($sce.RESOURCE_URL, value)`}
*
- * @param {*} value The value to trustAs.
- * @returns {*} An object that can be passed to {@link ng.$sce#getTrustedResourceUrl
- * $sce.getTrustedResourceUrl(value)} to obtain the original value. (privileged directives
- * only accept expressions that are either literal constants or are the return
- * value of {@link ng.$sce#trustAs $sce.trustAs}.)
+ * @param {*} value The value to mark as trusted for `$sce.RESOURCE_URL` context.
+ * @return {*} A wrapped version of value that can be used as a trusted variant of your `value`
+ * in `$sce.RESOURCE_URL` context (template URLs in `ng-include`, most `src` attribute
+ * bindings, ...)
*/
/**
@@ -29171,11 +30080,10 @@ function $SceProvider() {
* Shorthand method. `$sce.trustAsJs(value)` →
* {@link ng.$sceDelegate#trustAs `$sceDelegate.trustAs($sce.JS, value)`}
*
- * @param {*} value The value to trustAs.
- * @returns {*} An object that can be passed to {@link ng.$sce#getTrustedJs
- * $sce.getTrustedJs(value)} to obtain the original value. (privileged directives
- * only accept expressions that are either literal constants or are the
- * return value of {@link ng.$sce#trustAs $sce.trustAs}.)
+ * @param {*} value The value to mark as trusted for `$sce.JS` context.
+ * @return {*} A wrapped version of value that can be used as a trusted variant of your `value`
+ * in `$sce.JS` context. That context is currently unused, so there are almost no reasons to
+ * use this function so far.
*/
/**
@@ -29184,16 +30092,17 @@ function $SceProvider() {
*
* @description
* Delegates to {@link ng.$sceDelegate#getTrusted `$sceDelegate.getTrusted`}. As such,
- * takes the result of a {@link ng.$sce#trustAs `$sce.trustAs`}() call and returns the
- * originally supplied value if the queried context type is a supertype of the created type.
- * If this condition isn't satisfied, throws an exception.
+ * takes any input, and either returns a value that's safe to use in the specified context,
+ * or throws an exception. This function is aware of trusted values created by the `trustAs`
+ * function and its shorthands, and when contexts are appropriate, returns the unwrapped value
+ * as-is. Finally, this function can also throw when there is no way to turn `maybeTrusted` in a
+ * safe value (e.g., no sanitization is available or possible.)
*
- * @param {string} type The kind of context in which this value is to be used.
- * @param {*} maybeTrusted The result of a prior {@link ng.$sce#trustAs `$sce.trustAs`}
- * call.
- * @returns {*} The value the was originally provided to
- * {@link ng.$sce#trustAs `$sce.trustAs`} if valid in this context.
- * Otherwise, throws an exception.
+ * @param {string} type The context in which this value is to be used.
+ * @param {*} maybeTrusted The result of a prior {@link ng.$sce#trustAs
+ * `$sce.trustAs`} call, or anything else (which will not be considered trusted.)
+ * @return {*} A version of the value that's safe to use in the given context, or throws an
+ * exception if this is impossible.
*/
/**
@@ -29205,7 +30114,7 @@ function $SceProvider() {
* {@link ng.$sceDelegate#getTrusted `$sceDelegate.getTrusted($sce.HTML, value)`}
*
* @param {*} value The value to pass to `$sce.getTrusted`.
- * @returns {*} The return value of `$sce.getTrusted($sce.HTML, value)`
+ * @return {*} The return value of `$sce.getTrusted($sce.HTML, value)`
*/
/**
@@ -29217,7 +30126,7 @@ function $SceProvider() {
* {@link ng.$sceDelegate#getTrusted `$sceDelegate.getTrusted($sce.CSS, value)`}
*
* @param {*} value The value to pass to `$sce.getTrusted`.
- * @returns {*} The return value of `$sce.getTrusted($sce.CSS, value)`
+ * @return {*} The return value of `$sce.getTrusted($sce.CSS, value)`
*/
/**
@@ -29229,7 +30138,7 @@ function $SceProvider() {
* {@link ng.$sceDelegate#getTrusted `$sceDelegate.getTrusted($sce.URL, value)`}
*
* @param {*} value The value to pass to `$sce.getTrusted`.
- * @returns {*} The return value of `$sce.getTrusted($sce.URL, value)`
+ * @return {*} The return value of `$sce.getTrusted($sce.URL, value)`
*/
/**
@@ -29241,7 +30150,7 @@ function $SceProvider() {
* {@link ng.$sceDelegate#getTrusted `$sceDelegate.getTrusted($sce.RESOURCE_URL, value)`}
*
* @param {*} value The value to pass to `$sceDelegate.getTrusted`.
- * @returns {*} The return value of `$sce.getTrusted($sce.RESOURCE_URL, value)`
+ * @return {*} The return value of `$sce.getTrusted($sce.RESOURCE_URL, value)`
*/
/**
@@ -29253,7 +30162,7 @@ function $SceProvider() {
* {@link ng.$sceDelegate#getTrusted `$sceDelegate.getTrusted($sce.JS, value)`}
*
* @param {*} value The value to pass to `$sce.getTrusted`.
- * @returns {*} The return value of `$sce.getTrusted($sce.JS, value)`
+ * @return {*} The return value of `$sce.getTrusted($sce.JS, value)`
*/
/**
@@ -29265,12 +30174,12 @@ function $SceProvider() {
* {@link ng.$sce#parseAs `$sce.parseAs($sce.HTML, value)`}
*
* @param {string} expression String expression to compile.
- * @returns {function(context, locals)} a function which represents the compiled expression:
+ * @return {function(context, locals)} A function which represents the compiled expression:
*
- * * `context` – `{object}` – an object against which any expressions embedded in the strings
- * are evaluated against (typically a scope object).
- * * `locals` – `{object=}` – local variables context object, useful for overriding values in
- * `context`.
+ * * `context` – `{object}` – an object against which any expressions embedded in the
+ * strings are evaluated against (typically a scope object).
+ * * `locals` – `{object=}` – local variables context object, useful for overriding values
+ * in `context`.
*/
/**
@@ -29282,12 +30191,12 @@ function $SceProvider() {
* {@link ng.$sce#parseAs `$sce.parseAs($sce.CSS, value)`}
*
* @param {string} expression String expression to compile.
- * @returns {function(context, locals)} a function which represents the compiled expression:
+ * @return {function(context, locals)} A function which represents the compiled expression:
*
- * * `context` – `{object}` – an object against which any expressions embedded in the strings
- * are evaluated against (typically a scope object).
- * * `locals` – `{object=}` – local variables context object, useful for overriding values in
- * `context`.
+ * * `context` – `{object}` – an object against which any expressions embedded in the
+ * strings are evaluated against (typically a scope object).
+ * * `locals` – `{object=}` – local variables context object, useful for overriding values
+ * in `context`.
*/
/**
@@ -29299,12 +30208,12 @@ function $SceProvider() {
* {@link ng.$sce#parseAs `$sce.parseAs($sce.URL, value)`}
*
* @param {string} expression String expression to compile.
- * @returns {function(context, locals)} a function which represents the compiled expression:
+ * @return {function(context, locals)} A function which represents the compiled expression:
*
- * * `context` – `{object}` – an object against which any expressions embedded in the strings
- * are evaluated against (typically a scope object).
- * * `locals` – `{object=}` – local variables context object, useful for overriding values in
- * `context`.
+ * * `context` – `{object}` – an object against which any expressions embedded in the
+ * strings are evaluated against (typically a scope object).
+ * * `locals` – `{object=}` – local variables context object, useful for overriding values
+ * in `context`.
*/
/**
@@ -29316,12 +30225,12 @@ function $SceProvider() {
* {@link ng.$sce#parseAs `$sce.parseAs($sce.RESOURCE_URL, value)`}
*
* @param {string} expression String expression to compile.
- * @returns {function(context, locals)} a function which represents the compiled expression:
+ * @return {function(context, locals)} A function which represents the compiled expression:
*
- * * `context` – `{object}` – an object against which any expressions embedded in the strings
- * are evaluated against (typically a scope object).
- * * `locals` – `{object=}` – local variables context object, useful for overriding values in
- * `context`.
+ * * `context` – `{object}` – an object against which any expressions embedded in the
+ * strings are evaluated against (typically a scope object).
+ * * `locals` – `{object=}` – local variables context object, useful for overriding values
+ * in `context`.
*/
/**
@@ -29333,12 +30242,12 @@ function $SceProvider() {
* {@link ng.$sce#parseAs `$sce.parseAs($sce.JS, value)`}
*
* @param {string} expression String expression to compile.
- * @returns {function(context, locals)} a function which represents the compiled expression:
+ * @return {function(context, locals)} A function which represents the compiled expression:
*
- * * `context` – `{object}` – an object against which any expressions embedded in the strings
- * are evaluated against (typically a scope object).
- * * `locals` – `{object=}` – local variables context object, useful for overriding values in
- * `context`.
+ * * `context` – `{object}` – an object against which any expressions embedded in the
+ * strings are evaluated against (typically a scope object).
+ * * `locals` – `{object=}` – local variables context object, useful for overriding values
+ * in `context`.
*/
// Shorthand delegations.
@@ -29388,7 +30297,10 @@ function $SnifferProvider() {
// (see https://developer.chrome.com/apps/api_index). If sandboxed, they can be detected by
// the presence of an extension runtime ID and the absence of other Chrome runtime APIs
// (see https://developer.chrome.com/apps/manifest/sandbox).
+ // (NW.js apps have access to Chrome APIs, but do support `history`.)
+ isNw = $window.nw && $window.nw.process,
isChromePackagedApp =
+ !isNw &&
$window.chrome &&
($window.chrome.app && $window.chrome.app.runtime ||
!$window.chrome.app && $window.chrome.runtime && $window.chrome.runtime.id),
@@ -29761,7 +30673,7 @@ function $TimeoutProvider() {
timeout.cancel = function(promise) {
if (promise && promise.$$timeoutId in deferreds) {
// Timeout cancels should not report an unhandled promise.
- deferreds[promise.$$timeoutId].promise.catch(noop);
+ markQExceptionHandled(deferreds[promise.$$timeoutId].promise);
deferreds[promise.$$timeoutId].reject('canceled');
delete deferreds[promise.$$timeoutId];
return $browser.defer.cancel(promise.$$timeoutId);
@@ -29793,7 +30705,7 @@ var originUrl = urlResolve(window.location.href);
* URL will be resolved into an absolute URL in the context of the application document.
* Parsing means that the anchor node's host, hostname, protocol, port, pathname and related
* properties are all populated to reflect the normalized URL. This approach has wide
- * compatibility - Safari 1+, Mozilla 1+, Opera 7+,e etc. See
+ * compatibility - Safari 1+, Mozilla 1+ etc. See
* http://www.aptana.com/reference/html/api/HTMLAnchorElement.html
*
* Implementation Notes for IE
@@ -30159,6 +31071,9 @@ function $FilterProvider($provide) {
* Selects a subset of items from `array` and returns it as a new array.
*
* @param {Array} array The source array.
+ *
+ * **Note**: If the array contains objects that reference themselves, filtering is not possible.
+ *
* @param {string|Object|function()} expression The predicate to be used for selecting items from
* `array`.
*
@@ -30192,8 +31107,9 @@ function $FilterProvider($provide) {
* The final result is an array of those elements that the predicate returned true for.
*
* @param {function(actual, expected)|true|false} [comparator] Comparator which is used in
- * determining if the expected value (from the filter expression) and actual value (from
- * the object in the array) should be considered a match.
+ * determining if values retrieved using `expression` (when it is not a function) should be
+ * considered a match based on the expected value (from the filter expression) and actual
+ * value (from the object in the array).
*
* Can be one of:
*
@@ -30376,7 +31292,10 @@ function deepCompare(actual, expected, comparator, anyPropertyKey, matchAgainstA
var key;
if (matchAgainstAnyProp) {
for (key in actual) {
- if ((key.charAt(0) !== '$') && deepCompare(actual[key], expected, comparator, anyPropertyKey, true)) {
+ // Under certain, rare, circumstances, key may not be a string and `charAt` will be undefined
+ // See: https://github.com/angular/angular.js/issues/15644
+ if (key.charAt && (key.charAt(0) !== '$') &&
+ deepCompare(actual[key], expected, comparator, anyPropertyKey, true)) {
return true;
}
}
@@ -30885,7 +31804,7 @@ var DATE_FORMATS = {
GGGG: longEraGetter
};
-var DATE_FORMATS_SPLIT = /((?:[^yMLdHhmsaZEwG']+)|(?:'(?:[^']|'')*')|(?:E+|y+|M+|L+|d+|H+|h+|m+|s+|a|Z|G+|w+))(.*)/,
+var DATE_FORMATS_SPLIT = /((?:[^yMLdHhmsaZEwG']+)|(?:'(?:[^']|'')*')|(?:E+|y+|M+|L+|d+|H+|h+|m+|s+|a|Z|G+|w+))([\s\S]*)/,
NUMBER_STRING = /^-?\d+$/;
/**
@@ -30944,6 +31863,8 @@ var DATE_FORMATS_SPLIT = /((?:[^yMLdHhmsaZEwG']+)|(?:'(?:[^']|'')*')|(?:E+|y+|M+
* `"h 'in the morning'"`). In order to output a single quote, escape it - i.e., two single quotes in a sequence
* (e.g. `"h 'o''clock'"`).
*
+ * Any other characters in the `format` string will be output as-is.
+ *
* @param {(Date|number|string)} date Date to format either as Date object, milliseconds (string or
* number) or various ISO 8601 datetime string formats (e.g. yyyy-MM-ddTHH:mm:ss.sssZ and its
* shorter versions like yyyy-MM-ddTHH:mmZ, yyyy-MM-dd or yyyyMMddTHHmmssZ). If no timezone is
@@ -31106,6 +32027,9 @@ function jsonFilter() {
* @kind function
* @description
* Converts string to lowercase.
+ *
+ * See the {@link ng.uppercase uppercase filter documentation} for a functionally identical example.
+ *
* @see angular.lowercase
*/
var lowercaseFilter = valueFn(lowercase);
@@ -31117,7 +32041,23 @@ var lowercaseFilter = valueFn(lowercase);
* @kind function
* @description
* Converts string to uppercase.
- * @see angular.uppercase
+ * @example
+
+
+
+
+
+
{{title}}
+
+ {{title | uppercase}}
+
+
+
*/
var uppercaseFilter = valueFn(uppercase);
@@ -31306,6 +32246,9 @@ function sliceFn(input, begin, end) {
* dummy predicate that returns the item's index as `value`.
* (If you are using a custom comparator, make sure it can handle this predicate as well.)
*
+ * If a custom comparator still can't distinguish between two items, then they will be sorted based
+ * on their index using the built-in comparator.
+ *
* Finally, in an attempt to simplify things, if a predicate returns an object as the extracted
* value for an item, `orderBy` will try to convert that object to a primitive value, before passing
* it to the comparator. The following rules govern the conversion:
@@ -31852,7 +32795,7 @@ function orderByFilter($parse) {
}
}
- return compare(v1.tieBreaker, v2.tieBreaker) * descending;
+ return (compare(v1.tieBreaker, v2.tieBreaker) || defaultCompare(v1.tieBreaker, v2.tieBreaker)) * descending;
}
};
@@ -32149,7 +33092,8 @@ var htmlAnchorDirective = valueFn({
*
* @description
*
- * This directive sets the `disabled` attribute on the element if the
+ * This directive sets the `disabled` attribute on the element (typically a form control,
+ * e.g. `input`, `button`, `select` etc.) if the
* {@link guide/expression expression} inside `ngDisabled` evaluates to truthy.
*
* A special directive is necessary because we cannot use interpolation inside the `disabled`
@@ -32454,17 +33398,23 @@ function nullFormRenameControl(control, name) {
* @property {boolean} $dirty True if user has already interacted with the form.
* @property {boolean} $valid True if all of the containing forms and controls are valid.
* @property {boolean} $invalid True if at least one containing control or form is invalid.
- * @property {boolean} $pending True if at least one containing control or form is pending.
* @property {boolean} $submitted True if user has submitted the form even if its invalid.
*
- * @property {Object} $error Is an object hash, containing references to controls or
- * forms with failing validators, where:
+ * @property {Object} $pending An object hash, containing references to controls or forms with
+ * pending validators, where:
+ *
+ * - keys are validations tokens (error names).
+ * - values are arrays of controls or forms that have a pending validator for the given error name.
+ *
+ * See {@link form.FormController#$error $error} for a list of built-in validation tokens.
+ *
+ * @property {Object} $error An object hash, containing references to controls or forms with failing
+ * validators, where:
*
* - keys are validation tokens (error names),
- * - values are arrays of controls or forms that have a failing validator for given error name.
+ * - values are arrays of controls or forms that have a failing validator for the given error name.
*
* Built-in validation tokens:
- *
* - `email`
* - `max`
* - `maxlength`
@@ -32710,9 +33660,24 @@ FormController.prototype = {
* @name form.FormController#$setValidity
*
* @description
- * Sets the validity of a form control.
- *
- * This method will also propagate to parent forms.
+ * Change the validity state of the form, and notify the parent form (if any).
+ *
+ * Application developers will rarely need to call this method directly. It is used internally, by
+ * {@link ngModel.NgModelController#$setValidity NgModelController.$setValidity()}, to propagate a
+ * control's validity state to the parent `FormController`.
+ *
+ * @param {string} validationErrorKey Name of the validator. The `validationErrorKey` will be
+ * assigned to either `$error[validationErrorKey]` or `$pending[validationErrorKey]` (for
+ * unfulfilled `$asyncValidators`), so that it is available for data-binding. The
+ * `validationErrorKey` should be in camelCase and will get converted into dash-case for
+ * class name. Example: `myError` will result in `ng-valid-my-error` and
+ * `ng-invalid-my-error` classes and can be bound to as `{{ someForm.$error.myError }}`.
+ * @param {boolean} isValid Whether the current state is valid (true), invalid (false), pending
+ * (undefined), or skipped (null). Pending is used for unfulfilled `$asyncValidators`.
+ * Skipped is used by AngularJS when validators do not run because of parse errors and when
+ * `$asyncValidators` do not run because any of the `$validators` failed.
+ * @param {NgModelController | FormController} controller - The controller whose validity state is
+ * triggering the change.
*/
addSetValidityMethod({
clazz: FormController,
@@ -34655,15 +35620,27 @@ function isValidForStep(viewValue, stepBase, step) {
// and `viewValue` is expected to be a valid stringified number.
var value = Number(viewValue);
+ var isNonIntegerValue = !isNumberInteger(value);
+ var isNonIntegerStepBase = !isNumberInteger(stepBase);
+ var isNonIntegerStep = !isNumberInteger(step);
+
// Due to limitations in Floating Point Arithmetic (e.g. `0.3 - 0.2 !== 0.1` or
// `0.5 % 0.1 !== 0`), we need to convert all numbers to integers.
- if (!isNumberInteger(value) || !isNumberInteger(stepBase) || !isNumberInteger(step)) {
- var decimalCount = Math.max(countDecimals(value), countDecimals(stepBase), countDecimals(step));
+ if (isNonIntegerValue || isNonIntegerStepBase || isNonIntegerStep) {
+ var valueDecimals = isNonIntegerValue ? countDecimals(value) : 0;
+ var stepBaseDecimals = isNonIntegerStepBase ? countDecimals(stepBase) : 0;
+ var stepDecimals = isNonIntegerStep ? countDecimals(step) : 0;
+
+ var decimalCount = Math.max(valueDecimals, stepBaseDecimals, stepDecimals);
var multiplier = Math.pow(10, decimalCount);
value = value * multiplier;
stepBase = stepBase * multiplier;
step = step * multiplier;
+
+ if (isNonIntegerValue) value = Math.round(value);
+ if (isNonIntegerStepBase) stepBase = Math.round(stepBase);
+ if (isNonIntegerStep) step = Math.round(step);
}
return (value - stepBase) % step === 0;
@@ -35220,7 +36197,10 @@ var ngValueDirective = function() {
* makes it possible to use ngValue as a sort of one-way bind.
*/
function updateElementValue(element, attr, value) {
- element.prop('value', value);
+ // Support: IE9 only
+ // In IE9 values are converted to string (e.g. `input.value = null` results in `input.value === 'null'`).
+ var propValue = isDefined(value) ? value : (msie === 9) ? '' : null;
+ element.prop('value', propValue);
attr.$set('value', value);
}
@@ -36548,15 +37528,15 @@ forEach(
return {
restrict: 'A',
compile: function($element, attr) {
- // We expose the powerful $event object on the scope that provides access to the Window,
- // etc. that isn't protected by the fast paths in $parse. We explicitly request better
- // checks at the cost of speed since event handler expressions are not executed as
- // frequently as regular change detection.
- var fn = $parse(attr[directiveName], /* interceptorFn */ null, /* expensiveChecks */ true);
+ // NOTE:
+ // We expose the powerful `$event` object on the scope that provides access to the Window,
+ // etc. This is OK, because expressions are not sandboxed any more (and the expression
+ // sandbox was never meant to be a security feature anyway).
+ var fn = $parse(attr[directiveName]);
return function ngEventHandler(scope, element) {
element.on(eventName, function(event) {
var callback = function() {
- fn(scope, {$event:event});
+ fn(scope, {$event: event});
};
if (forceAsyncEvents[eventName] && $rootScope.$$phase) {
scope.$evalAsync(callback);
@@ -37637,32 +38617,57 @@ var ngModelMinErr = minErr('ngModel');
* @property {*} $viewValue The actual value from the control's view. For `input` elements, this is a
* String. See {@link ngModel.NgModelController#$setViewValue} for information about when the $viewValue
* is set.
+ *
* @property {*} $modelValue The value in the model that the control is bound to.
+ *
* @property {Array.} $parsers Array of functions to execute, as a pipeline, whenever
- the control reads value from the DOM. The functions are called in array order, each passing
- its return value through to the next. The last return value is forwarded to the
- {@link ngModel.NgModelController#$validators `$validators`} collection.
+ * the control updates the ngModelController with a new {@link ngModel.NgModelController#$viewValue
+ `$viewValue`} from the DOM, usually via user input.
+ See {@link ngModel.NgModelController#$setViewValue `$setViewValue()`} for a detailed lifecycle explanation.
+ Note that the `$parsers` are not called when the bound ngModel expression changes programmatically.
+
+ The functions are called in array order, each passing
+ its return value through to the next. The last return value is forwarded to the
+ {@link ngModel.NgModelController#$validators `$validators`} collection.
-Parsers are used to sanitize / convert the {@link ngModel.NgModelController#$viewValue
-`$viewValue`}.
+ Parsers are used to sanitize / convert the {@link ngModel.NgModelController#$viewValue
+ `$viewValue`}.
-Returning `undefined` from a parser means a parse error occurred. In that case,
-no {@link ngModel.NgModelController#$validators `$validators`} will run and the `ngModel`
-will be set to `undefined` unless {@link ngModelOptions `ngModelOptions.allowInvalid`}
-is set to `true`. The parse error is stored in `ngModel.$error.parse`.
+ Returning `undefined` from a parser means a parse error occurred. In that case,
+ no {@link ngModel.NgModelController#$validators `$validators`} will run and the `ngModel`
+ will be set to `undefined` unless {@link ngModelOptions `ngModelOptions.allowInvalid`}
+ is set to `true`. The parse error is stored in `ngModel.$error.parse`.
+
+ This simple example shows a parser that would convert text input value to lowercase:
+ * ```js
+ * function parse(value) {
+ * if (value) {
+ * return value.toLowerCase();
+ * }
+ * }
+ * ngModelController.$parsers.push(parse);
+ * ```
*
* @property {Array.} $formatters Array of functions to execute, as a pipeline, whenever
- the model value changes. The functions are called in reverse array order, each passing the value through to the
- next. The last return value is used as the actual DOM value.
- Used to format / convert values for display in the control.
+ the bound ngModel expression changes programmatically. The `$formatters` are not called when the
+ value of the control is changed by user interaction.
+
+ Formatters are used to format / convert the {@link ngModel.NgModelController#$modelValue
+ `$modelValue`} for display in the control.
+
+ The functions are called in reverse array order, each passing the value through to the
+ next. The last return value is used as the actual DOM value.
+
+ This simple example shows a formatter that would convert the model value to uppercase:
+
* ```js
- * function formatter(value) {
+ * function format(value) {
* if (value) {
* return value.toUpperCase();
* }
* }
- * ngModel.$formatters.push(formatter);
+ * ngModel.$formatters.push(format);
* ```
*
* @property {Object.} $validators A collection of validators that are applied
@@ -37862,7 +38867,9 @@ function NgModelController($scope, $exceptionHandler, $attr, $element, $parse, $
this.$$currentValidationRunId = 0;
- this.$$scope = $scope;
+ // https://github.com/angular/angular.js/issues/15833
+ // Prevent `$$scope` from being iterated over by `copy` when NgModelController is deep watched
+ Object.defineProperty(this, '$$scope', {value: $scope});
this.$$attr = $attr;
this.$$element = $element;
this.$$animate = $animate;
@@ -38370,9 +39377,10 @@ NgModelController.prototype = {
*
* When `$setViewValue` is called, the new `value` will be staged for committing through the `$parsers`
* and `$validators` pipelines. If there are no special {@link ngModelOptions} specified then the staged
- * value sent directly for processing, finally to be applied to `$modelValue` and then the
- * **expression** specified in the `ng-model` attribute. Lastly, all the registered change listeners,
- * in the `$viewChangeListeners` list, are called.
+ * value is sent directly for processing through the `$parsers` pipeline. After this, the `$validators` and
+ * `$asyncValidators` are called and the value is applied to `$modelValue`.
+ * Finally, the value is set to the **expression** specified in the `ng-model` attribute and
+ * all the registered change listeners, in the `$viewChangeListeners` list are called.
*
* In case the {@link ng.directive:ngModelOptions ngModelOptions} directive is used with `updateOn`
* and the `default` trigger is not listed, all those actions will remain pending until one of the
@@ -38435,6 +39443,29 @@ NgModelController.prototype = {
that.$commitViewValue();
});
}
+ },
+
+ /**
+ * @ngdoc method
+ *
+ * @name ngModel.NgModelController#$overrideModelOptions
+ *
+ * @description
+ *
+ * Override the current model options settings programmatically.
+ *
+ * The previous `ModelOptions` value will not be modified. Instead, a
+ * new `ModelOptions` object will inherit from the previous one overriding
+ * or inheriting settings that are defined in the given parameter.
+ *
+ * See {@link ngModelOptions} for information about what options can be specified
+ * and how model option inheritance works.
+ *
+ * @param {Object} options a hash of settings to override the previous options
+ *
+ */
+ $overrideModelOptions: function(options) {
+ this.$options = this.$options.createChild(options);
}
};
@@ -38447,8 +39478,8 @@ function setupModelWatcher(ctrl) {
// -> scope value did not change since the last digest as
// ng-change executes in apply phase
// 4. view should be changed back to 'a'
- ctrl.$$scope.$watch(function ngModelWatch() {
- var modelValue = ctrl.$$ngModelGet(ctrl.$$scope);
+ ctrl.$$scope.$watch(function ngModelWatch(scope) {
+ var modelValue = ctrl.$$ngModelGet(scope);
// if scope model value and ngModel value are out of sync
// TODO(perf): why not move this to the action fn?
@@ -38497,7 +39528,7 @@ function setupModelWatcher(ctrl) {
* (for unfulfilled `$asyncValidators`), so that it is available for data-binding.
* The `validationErrorKey` should be in camelCase and will get converted into dash-case
* for class name. Example: `myError` will result in `ng-valid-my-error` and `ng-invalid-my-error`
- * class and can be bound to as `{{someForm.someControl.$error.myError}}` .
+ * classes and can be bound to as `{{ someForm.someControl.$error.myError }}`.
* @param {boolean} isValid Whether the current state is valid (true), invalid (false), pending (undefined),
* or skipped (null). Pending is used for unfulfilled `$asyncValidators`.
* Skipped is used by Angular when validators do not run because of parse errors and
@@ -39276,13 +40307,8 @@ var ngOptionsMinErr = minErr('ngOptions');
* is not matched against any `