@angular/core 11.0.4 → 11.0.8

package/bundles/core.umd.js

@@ -1,5 +1,5 @@
 /**
- * @license Angular v11.0.4
+ * @license Angular v11.0.8
  * (c) 2010-2020 Google LLC. https://angular.io/
  * License: MIT
  */
@@ -2713,8 +2713,9 @@
             (currentView[PREORDER_HOOK_FLAGS] & 65535 /* IndexOfTheNextPreOrderHookMaskMask */) :
             0;
         var nodeIndexLimit = currentNodeIndex != null ? currentNodeIndex : -1;
+        var max = arr.length - 1; // Stop the loop at length - 1, because we look for the hook at i + 1
         var lastNodeIndexFound = 0;
-        for (var i = startIndex; i < arr.length; i++) {
+        for (var i = startIndex; i < max; i++) {
             var hook = arr[i + 1];
             if (typeof hook === 'number') {
                 lastNodeIndexFound = arr[i];
@@ -2751,8 +2752,7 @@
         var directive = currentView[directiveIndex];
         if (isInitHook) {
             var indexWithintInitPhase = currentView[FLAGS] >> 11 /* IndexWithinInitPhaseShift */;
-            // The init phase state must be always checked here as it may have been recursively
-            // updated
+            // The init phase state must be always checked here as it may have been recursively updated.
             if (indexWithintInitPhase <
                 (currentView[PREORDER_HOOK_FLAGS] >> 16 /* NumberOfInitHooksCalledShift */) &&
                 (currentView[FLAGS] & 3 /* InitPhaseStateMask */) === initPhase) {
@@ -5274,6 +5274,9 @@
                     else if (meta instanceof Self || meta.ngMetadataName === 'Self' || meta === Self) {
                         flags |= exports.InjectFlags.Self;
                     }
+                    else if (meta instanceof Host || meta.ngMetadataName === 'Host' || meta === Host) {
+                        flags |= exports.InjectFlags.Host;
+                    }
                     else if (meta instanceof Inject || meta === Inject) {
                         type = meta.token;
                     }
@@ -5590,14 +5593,16 @@
      * Fallback: InertDocument strategy
      */
     function getInertBodyHelper(defaultDoc) {
-        return isDOMParserAvailable() ? new DOMParserHelper() : new InertDocumentHelper(defaultDoc);
+        var inertDocumentHelper = new InertDocumentHelper(defaultDoc);
+        return isDOMParserAvailable() ? new DOMParserHelper(inertDocumentHelper) : inertDocumentHelper;
     }
     /**
      * Uses DOMParser to create and fill an inert body element.
      * This is the default strategy used in browsers that support it.
      */
     var DOMParserHelper = /** @class */ (function () {
-        function DOMParserHelper() {
+        function DOMParserHelper(inertDocumentHelper) {
+            this.inertDocumentHelper = inertDocumentHelper;
         }
         DOMParserHelper.prototype.getInertBodyElement = function (html) {
             // We add these extra elements to ensure that the rest of the content is parsed as expected
@@ -5609,6 +5614,12 @@
                 var body = new window.DOMParser()
                     .parseFromString(trustedHTMLFromString(html), 'text/html')
                     .body;
+                if (body === null) {
+                    // In some browsers (e.g. Mozilla/5.0 iPad AppleWebKit Mobile) the `body` property only
+                    // becomes available in the following tick of the JS engine. In that case we fall back to
+                    // the `inertDocumentHelper` instead.
+                    return this.inertDocumentHelper.getInertBodyElement(html);
+                }
                 body.removeChild(body.firstChild);
                 return body;
             }
@@ -6397,6 +6408,42 @@
         name: 'no-errors-schema'
     };
 
+    /**
+     * @license
+     * Copyright Google LLC All Rights Reserved.
+     *
+     * Use of this source code is governed by an MIT-style license that can be
+     * found in the LICENSE file at https://angular.io/license
+     */
+    var END_COMMENT = /-->/g;
+    var END_COMMENT_ESCAPED = '-\u200B-\u200B>';
+    /**
+     * Escape the content of the strings so that it can be safely inserted into a comment node.
+     *
+     * The issue is that HTML does not specify any way to escape comment end text inside the comment.
+     * `<!-- The way you close a comment is with "-->". -->`. Above the `"-->"` is meant to be text not
+     * an end to the comment. This can be created programmatically through DOM APIs.
+     *
+     * ```
+     * div.innerHTML = div.innerHTML
+     * ```
+     *
+     * One would expect that the above code would be safe to do, but it turns out that because comment
+     * text is not escaped, the comment may contain text which will prematurely close the comment
+     * opening up the application for XSS attack. (In SSR we programmatically create comment nodes which
+     * may contain such text and expect them to be safe.)
+     *
+     * This function escapes the comment text by looking for the closing char sequence `-->` and replace
+     * it with `-_-_>` where the `_` is a zero width space `\u200B`. The result is that if a comment
+     * contains `-->` text it will render normally but it will not cause the HTML parser to close the
+     * comment.
+     *
+     * @param value text to make safe for comment node by escaping the comment close character sequence
+     */
+    function escapeCommentText(value) {
+        return value.replace(END_COMMENT, END_COMMENT_ESCAPED);
+    }
+
     /**
      * @license
      * Copyright Google LLC All Rights Reserved.
@@ -7075,7 +7122,7 @@
         ngDevMode && ngDevMode.rendererCreateComment++;
         // isProceduralRenderer check is not needed because both `Renderer2` and `Renderer3` have the same
         // method name.
-        return renderer.createComment(value);
+        return renderer.createComment(escapeCommentText(value));
     }
     /**
      * Creates a native element from a tag name, using a renderer.
@@ -7411,12 +7458,12 @@
                     tCleanup[i].call(context);
                 }
             }
-            if (lCleanup !== null) {
-                for (var i = lastLCleanupIndex + 1; i < lCleanup.length; i++) {
-                    var instanceCleanupFn = lCleanup[i];
-                    ngDevMode && assertFunction(instanceCleanupFn, 'Expecting instance cleanup function.');
-                    instanceCleanupFn();
-                }
+        }
+        if (lCleanup !== null) {
+            for (var i = lastLCleanupIndex + 1; i < lCleanup.length; i++) {
+                var instanceCleanupFn = lCleanup[i];
+                ngDevMode && assertFunction(instanceCleanupFn, 'Expecting instance cleanup function.');
+                instanceCleanupFn();
             }
             lView[CLEANUP] = null;
         }
@@ -9980,19 +10027,19 @@
      * is `null` and the function is store in `LView` (rather than it `TView`).
      */
     function storeCleanupWithContext(tView, lView, context, cleanupFn) {
-        var lCleanup = getLCleanup(lView);
+        var lCleanup = getOrCreateLViewCleanup(lView);
         if (context === null) {
             // If context is null that this is instance specific callback. These callbacks can only be
             // inserted after template shared instances. For this reason in ngDevMode we freeze the TView.
             if (ngDevMode) {
-                Object.freeze(getTViewCleanup(tView));
+                Object.freeze(getOrCreateTViewCleanup(tView));
             }
             lCleanup.push(cleanupFn);
         }
         else {
             lCleanup.push(context);
             if (tView.firstCreatePass) {
-                getTViewCleanup(tView).push(cleanupFn, lCleanup.length - 1);
+                getOrCreateTViewCleanup(tView).push(cleanupFn, lCleanup.length - 1);
             }
         }
     }
@@ -10225,7 +10272,7 @@
             }
         }
         else {
-            var textContent = "bindings=" + JSON.stringify((_a = {}, _a[attrName] = debugValue, _a), null, 2);
+            var textContent = escapeCommentText("bindings=" + JSON.stringify((_a = {}, _a[attrName] = debugValue, _a), null, 2));
             if (isProceduralRenderer(renderer)) {
                 renderer.setValue(element, textContent);
             }
@@ -11075,11 +11122,11 @@
         }
     }
     var CLEAN_PROMISE = _CLEAN_PROMISE;
-    function getLCleanup(view) {
+    function getOrCreateLViewCleanup(view) {
         // top level variables should not be exported for performance reasons (PERF_NOTES.md)
         return view[CLEANUP] || (view[CLEANUP] = ngDevMode ? new LCleanup() : []);
     }
-    function getTViewCleanup(tView) {
+    function getOrCreateTViewCleanup(tView) {
         return tView.cleanup || (tView.cleanup = ngDevMode ? new TCleanup() : []);
     }
     /**
@@ -15380,11 +15427,11 @@
         if (useCapture === void 0) { useCapture = false; }
         var isTNodeDirectiveHost = isDirectiveHost(tNode);
         var firstCreatePass = tView.firstCreatePass;
-        var tCleanup = firstCreatePass && getTViewCleanup(tView);
+        var tCleanup = firstCreatePass && getOrCreateTViewCleanup(tView);
         // When the ɵɵlistener instruction was generated and is executed we know that there is either a
         // native listener or a directive output on this element. As such we we know that we will have to
         // register a listener and store its cleanup function on LView.
-        var lCleanup = getLCleanup(lView);
+        var lCleanup = getOrCreateLViewCleanup(lView);
         ngDevMode && assertTNodeType(tNode, 3 /* AnyRNode */ | 12 /* AnyContainer */);
         var processOutputs = true;
         // add native event listener - applicable to elements only
@@ -21678,7 +21725,7 @@
     /**
      * @publicApi
      */
-    var VERSION = new Version('11.0.4');
+    var VERSION = new Version('11.0.8');
 
     /**
      * @license
@@ -22851,7 +22898,7 @@
             this._lView = _lView;
             this._cdRefInjectingView = _cdRefInjectingView;
             this._appRef = null;
-            this._viewContainerRef = null;
+            this._attachedToViewContainer = false;
         }
         Object.defineProperty(ViewRef.prototype, "rootNodes", {
             get: function () {
@@ -22880,12 +22927,19 @@
             if (this._appRef) {
                 this._appRef.detachView(this);
             }
-            else if (this._viewContainerRef) {
-                var index = this._viewContainerRef.indexOf(this);
-                if (index > -1) {
-                    this._viewContainerRef.detach(index);
+            else if (this._attachedToViewContainer) {
+                var parent = this._lView[PARENT];
+                if (isLContainer(parent)) {
+                    var viewRefs = parent[VIEW_REFS];
+                    var index = viewRefs ? viewRefs.indexOf(this) : -1;
+                    if (index > -1) {
+                        ngDevMode &&
+                            assertEqual(index, parent.indexOf(this._lView) - CONTAINER_HEADER_OFFSET, 'An attached view should be in the same position within its container as its ViewRef in the VIEW_REFS array.');
+                        detachView(parent, index);
+                        removeFromArray(viewRefs, index);
+                    }
                 }
-                this._viewContainerRef = null;
+                this._attachedToViewContainer = false;
             }
             destroyLView(this._lView[TVIEW], this._lView);
         };
@@ -23077,18 +23131,18 @@
         ViewRef.prototype.checkNoChanges = function () {
             checkNoChangesInternal(this._lView[TVIEW], this._lView, this.context);
         };
-        ViewRef.prototype.attachToViewContainerRef = function (vcRef) {
+        ViewRef.prototype.attachToViewContainerRef = function () {
             if (this._appRef) {
                 throw new Error('This view is already attached directly to the ApplicationRef!');
             }
-            this._viewContainerRef = vcRef;
+            this._attachedToViewContainer = true;
         };
         ViewRef.prototype.detachFromAppRef = function () {
             this._appRef = null;
             renderDetachView(this._lView[TVIEW], this._lView);
         };
         ViewRef.prototype.attachToAppRef = function (appRef) {
-            if (this._viewContainerRef) {
+            if (this._attachedToViewContainer) {
                 throw new Error('This view is already attached to a ViewContainer!');
             }
             this._appRef = appRef;
@@ -23500,7 +23554,7 @@
             if (parentRNode !== null) {
                 addViewToContainer(tView, lContainer[T_HOST], renderer, lView, parentRNode, beforeNode);
             }
-            viewRef.attachToViewContainerRef(this);
+            viewRef.attachToViewContainerRef();
             addToArray(getOrCreateViewRefs(lContainer), adjustedIdx, viewRef);
             return viewRef;
         };
@@ -29295,6 +29349,11 @@
         if (_runModeLocked) {
             throw new Error('Cannot enable prod mode after platform setup.');
         }
+        // The below check is there so when ngDevMode is set via terser
+        // `global['ngDevMode'] = false;` is also dropped.
+        if (typeof ngDevMode === undefined || !!ngDevMode) {
+            _global['ngDevMode'] = false;
+        }
         _devMode = false;
     }
 
@@ -29387,7 +29446,7 @@
     }
     /**
      * Creates a factory for a platform. Can be used to provide or override `Providers` specific to
-     * your applciation's runtime needs, such as `PLATFORM_INITIALIZER` and `PLATFORM_ID`.
+     * your application's runtime needs, such as `PLATFORM_INITIALIZER` and `PLATFORM_ID`.
      * @param parentPlatformFactory Another platform factory to modify. Allows you to compose factories
      * to build up configurations that might be required by different libraries or parts of the
      * application.
@@ -32928,7 +32987,7 @@
                 var el = asElementData(view, elDef.nodeIndex).renderElement;
                 if (!elDef.element.name) {
                     // a comment.
-                    view.renderer.setValue(el, "bindings=" + JSON.stringify(bindingValues, null, 2));
+                    view.renderer.setValue(el, escapeCommentText("bindings=" + JSON.stringify(bindingValues, null, 2)));
                 }
                 else {
                     // a regular element.
@@ -33217,7 +33276,7 @@
             return el;
         };
         DebugRenderer2.prototype.createComment = function (value) {
-            var comment = this.delegate.createComment(value);
+            var comment = this.delegate.createComment(escapeCommentText(value));
             var debugCtx = this.createDebugContext(comment);
             if (debugCtx) {
                 indexDebugNode(new DebugNode__PRE_R3__(comment, null, debugCtx));