10.0.x cp of: fix(core): do not trigger CSP alert/report in Firefox and Chrome #36578 #37783

IgorMinar · 2020-06-26T22:17:53Z

cherry-pick of #36578

googlebot · 2020-06-26T22:18:07Z

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

ngbot · 2020-06-26T22:18:39Z

I see that you just added the PR action: merge label, but the following checks are still failing:
     status "cla/google" is failing
     status "ci/circleci: setup" is pending
     status "google3" is pending
     status "pullapprove" is pending
     missing required status "ci/circleci: build"
     missing required status "ci/circleci: lint"
     missing required status "ci/circleci: publish_snapshot"
     missing required status "ci/angular: size"
     4 pending code reviews

If you want your PR to be merged, it has to pass all the CI checks.

If you can't get the PR to a green state due to flakes or broken master, please try rebasing to master and/or restarting the CI job. If that fails and you believe that the issue is not due to your change, please contact the caretaker and ask for help.

googlebot · 2020-06-26T22:18:39Z

A Googler has manually verified that the CLAs look good.

(Googler, please make sure the reason for overriding the CLA status is clearly documented in these comments.)

ℹ️ Googlers: Go here for more info.

IgorMinar · 2020-06-26T22:20:07Z

merge-assistance: global-self-approval since this is a cherry-pick

mary-poppins · 2020-06-26T22:31:13Z

You can preview ab12b6a at https://pr37783-ab12b6a.ngbuilds.io/.

…ular#36578) If [innerHTML] is used in a component and a Content-Security-Policy is set that does not allow inline styles then Firefox and Chrome show the following message: > Content Security Policy: The page’s settings observed the loading of a resource at self (“default-src”). A CSP report is being sent. This message is caused because Angular is creating an inline style tag to test for a browser bug that we use to decide what sanitization strategy to use, which causes CSP violation errors if inline CSS is prohibited. This test is no longer necessary, since the `DOMParser` is now safe to use and the `style` based check is redundant. In this fix, we default to using `DOMParser` if it is available and fall back to `createHTMLDocument()` if needed. This is the approach used by DOMPurify too. The related unit tests in `html_sanitizer_spec.ts`, "should not allow JavaScript execution when creating inert document" and "should not allow JavaScript hidden in badly formed HTML to get through sanitization (Firefox bug)", are left untouched to assert that the behavior hasn't changed in those scenarios. Fixes angular#25214.

…6578) The `inertDocument` member is only needed when using the InertDocument strategy. By separating the DOMParser and InertDocument strategies into separate classes, we can easily avoid creating the inert document unnecessarily when using DOMParser.

…#36578) Verify that HTML parsing is supported in addition to DOMParser existence. This maybe wasn't as important before when DOMParser was used just as a fallback on Firefox, but now that DOMParser is the default choice, we need to be more accurate.

googlebot · 2020-06-27T00:04:58Z

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

googlebot · 2020-06-27T00:05:22Z

A Googler has manually verified that the CLAs look good.

(Googler, please make sure the reason for overriding the CLA status is clearly documented in these comments.)

ℹ️ Googlers: Go here for more info.

mary-poppins · 2020-06-27T00:16:24Z

You can preview c35c07b at https://pr37783-c35c07b.ngbuilds.io/.

…troy (angular#37543) Invoking a callback registered through `ViewRef.onDestroy` throws an error, because we weren't registering it correctly in the internal data structure. These changes also remove the `storeCleanupFn` function, because it was mostly identical to `storeCleanupWithContext` and was only used in one place. Fixes angular#36213. PR Close angular#37543

googlebot · 2020-06-27T00:48:26Z

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

googlebot · 2020-06-27T00:48:52Z

A Googler has manually verified that the CLAs look good.

(Googler, please make sure the reason for overriding the CLA status is clearly documented in these comments.)

ℹ️ Googlers: Go here for more info.

mary-poppins · 2020-06-27T01:02:23Z

You can preview f82c0f9 at https://pr37783-f82c0f9.ngbuilds.io/.

) (#37783) If [innerHTML] is used in a component and a Content-Security-Policy is set that does not allow inline styles then Firefox and Chrome show the following message: > Content Security Policy: The page’s settings observed the loading of a resource at self (“default-src”). A CSP report is being sent. This message is caused because Angular is creating an inline style tag to test for a browser bug that we use to decide what sanitization strategy to use, which causes CSP violation errors if inline CSS is prohibited. This test is no longer necessary, since the `DOMParser` is now safe to use and the `style` based check is redundant. In this fix, we default to using `DOMParser` if it is available and fall back to `createHTMLDocument()` if needed. This is the approach used by DOMPurify too. The related unit tests in `html_sanitizer_spec.ts`, "should not allow JavaScript execution when creating inert document" and "should not allow JavaScript hidden in badly formed HTML to get through sanitization (Firefox bug)", are left untouched to assert that the behavior hasn't changed in those scenarios. Fixes #25214. PR Close #37783

…37783) The `inertDocument` member is only needed when using the InertDocument strategy. By separating the DOMParser and InertDocument strategies into separate classes, we can easily avoid creating the inert document unnecessarily when using DOMParser. PR Close #37783

…#37783) Verify that HTML parsing is supported in addition to DOMParser existence. This maybe wasn't as important before when DOMParser was used just as a fallback on Firefox, but now that DOMParser is the default choice, we need to be more accurate. PR Close #37783

…troy (#37543) (#37783) Invoking a callback registered through `ViewRef.onDestroy` throws an error, because we weren't registering it correctly in the internal data structure. These changes also remove the `storeCleanupFn` function, because it was mostly identical to `storeCleanupWithContext` and was only used in one place. Fixes #36213. PR Close #37543 PR Close #37783

AndrewKushnir · 2020-06-29T17:28:35Z

FYI, this PR is now merged to the patch branch. Thank you.

angular-automatic-lock-bot · 2020-07-30T16:15:19Z

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}

pullapprove bot requested review from alxhub, jelbourn, mhevery and pkozlowski-opensource June 26, 2020 22:18

googlebot added the cla: no label Jun 26, 2020

IgorMinar added cla: yes action: merge The PR is ready for merge by the caretaker PR target: patch-only and removed cla: no labels Jun 26, 2020

IgorMinar requested a review from AndrewKushnir June 26, 2020 22:19

IgorMinar added the merge: caretaker note Alert the caretaker performing the merge to check the PR for an out of normal action needed or note label Jun 26, 2020

IgorMinar added the action: cleanup The PR is in need of cleanup, either due to needing a rebase or in response to comments from reviews label Jun 26, 2020

peruukki added 3 commits June 26, 2020 17:04

IgorMinar force-pushed the sanitize-inert-remove-inline-style-10.0.x branch from ab12b6a to c35c07b Compare June 27, 2020 00:04

googlebot added cla: no and removed cla: yes labels Jun 27, 2020

IgorMinar added cla: yes and removed cla: no labels Jun 27, 2020

IgorMinar force-pushed the sanitize-inert-remove-inline-style-10.0.x branch from c35c07b to f82c0f9 Compare June 27, 2020 00:48

googlebot added cla: no and removed cla: yes labels Jun 27, 2020

IgorMinar added cla: yes and removed action: cleanup The PR is in need of cleanup, either due to needing a rebase or in response to comments from reviews cla: no labels Jun 27, 2020

AndrewKushnir approved these changes Jun 27, 2020

View reviewed changes

IgorMinar mentioned this pull request Jun 27, 2020

fix(core): do not trigger CSP alert/report in Firefox and Chrome #36578

Closed

14 tasks

AndrewKushnir closed this Jun 29, 2020

angular-automatic-lock-bot bot locked and limited conversation to collaborators Jul 30, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

10.0.x cp of: fix(core): do not trigger CSP alert/report in Firefox and Chrome #36578 #37783

10.0.x cp of: fix(core): do not trigger CSP alert/report in Firefox and Chrome #36578 #37783

Uh oh!

IgorMinar commented Jun 26, 2020

Uh oh!

googlebot commented Jun 26, 2020

Uh oh!

ngbot bot commented Jun 26, 2020

Uh oh!

googlebot commented Jun 26, 2020

Uh oh!

IgorMinar commented Jun 26, 2020 •

edited

Loading

Uh oh!

mary-poppins commented Jun 26, 2020

Uh oh!

googlebot commented Jun 27, 2020

Uh oh!

googlebot commented Jun 27, 2020

Uh oh!

mary-poppins commented Jun 27, 2020

Uh oh!

googlebot commented Jun 27, 2020

Uh oh!

googlebot commented Jun 27, 2020

Uh oh!

mary-poppins commented Jun 27, 2020

Uh oh!

AndrewKushnir commented Jun 29, 2020

Uh oh!

angular-automatic-lock-bot bot commented Jul 30, 2020

Uh oh!

Uh oh!

10.0.x cp of: fix(core): do not trigger CSP alert/report in Firefox and Chrome #36578 #37783

10.0.x cp of: fix(core): do not trigger CSP alert/report in Firefox and Chrome #36578 #37783

Uh oh!

Conversation

IgorMinar commented Jun 26, 2020

Uh oh!

googlebot commented Jun 26, 2020

Uh oh!

ngbot bot commented Jun 26, 2020

Uh oh!

googlebot commented Jun 26, 2020

Uh oh!

IgorMinar commented Jun 26, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mary-poppins commented Jun 26, 2020

Uh oh!

googlebot commented Jun 27, 2020

Uh oh!

googlebot commented Jun 27, 2020

Uh oh!

mary-poppins commented Jun 27, 2020

Uh oh!

googlebot commented Jun 27, 2020

Uh oh!

googlebot commented Jun 27, 2020

Uh oh!

mary-poppins commented Jun 27, 2020

Uh oh!

AndrewKushnir commented Jun 29, 2020

Uh oh!

angular-automatic-lock-bot bot commented Jul 30, 2020

Uh oh!

Uh oh!

IgorMinar commented Jun 26, 2020 •

edited

Loading