Skip to content

Conversation

@oburakevych
Copy link

@oburakevych oburakevych commented Dec 22, 2017

When building an Angular app with Angular CLI, resources in CSS, e.g. svg images, less than 10kb in size will be inlined.

This sounds like a good concept from the performance point of view, however, it may violate very strict Content Security Policies in some apps, which has to satisfy stricter security requirements: #8945

data: Allows data: URIs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URIs. Use this sparingly and definitely not for scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src

Instead of ejecting webpack, this PR adds a new build flag
--inline-asset-max-size that instructs Angular CLI NOT to inline any assets, e.g. images, in CSS due to strict CSP requirements.

  • Added build flag --inline-asset-max-size - Maximum size (in Kb) of assets to be inlined
  • Positive integer defines the max number of assets to be inlined
  • Negative integer - no assets to be inlined.

If a resource is less than 10kb it will also be inlined.
If a resource is less than 10kb it will also be inlined by default.

By using flaf `--inline-asset-max-size` it's possible to define the max size of the

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

typo "flag"

Copy link
Member

@clydin clydin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's already a massive amount of command line options and this is something that would probably be set at an application level and not be changed. As such, an app config option would probably be more appropriate.

},
{
// TODO: inline .cur if not supporting IE (use browserslist to check)
filter: (asset: any) => !asset.hash && !asset.absolutePath.endsWith('.cur'),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of the extra function (which is breaking the eject command). Add a condition to the filter here.
Also the semantics of the option values should be changed. A maximum size of zero (0) means nothing should be inlined. Infinity would mean everything should be inlined.

'src/assets/small-id.svg': imgSvg
}))
.then(() => copyProjectAsset('images/spectrum.png', './assets/large.png'))
.then(() => ng('build', '--extract-css', '--inline-asset-max-size=-1', '--aot'))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tests for inlining all resources and at an arbitrary non-default value would also be needed.

@clydin
Copy link
Member

clydin commented Feb 23, 2018

Closing this as infrastructure to more easily support this feature has been added since this PR's creation and a major refactoring of the build system in the next major version will provide a mechanism for the addition of features such as this.

@clydin clydin closed this Feb 23, 2018
@filipvh
Copy link

filipvh commented Mar 4, 2018

@clydin how would i go about this?

@kuncevic
Copy link

kuncevic commented Aug 4, 2018

Any news? Just want to inline all of my images without ejecting the config

@angular-automatic-lock-bot
Copy link

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot bot locked and limited conversation to collaborators Sep 12, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants