@angular/core 9.1.9 → 9.1.13

package/fesm2015/core.js

@@ -1,5 +1,5 @@
 /**
- * @license Angular v9.1.9
+ * @license Angular v9.1.13
  * (c) 2010-2020 Google LLC. https://angular.io/
  * License: MIT
  */
@@ -6148,23 +6148,36 @@ function ɵɵgetInheritedFactory(type) {
      */
     () => {
         /** @type {?} */
-        const proto = (/** @type {?} */ (Object.getPrototypeOf(type.prototype).constructor));
+        const ownConstructor = type.prototype.constructor;
         /** @type {?} */
-        const factory = ((/** @type {?} */ (proto)))[NG_FACTORY_DEF] || ɵɵgetFactoryOf(proto);
-        if (factory !== null) {
-            return factory;
-        }
-        else {
-            // There is no factory defined. Either this was improper usage of inheritance
-            // (no Angular decorator on the superclass) or there is no constructor at all
-            // in the inheritance chain. Since the two cases cannot be distinguished, the
-            // latter has to be assumed.
-            return (/**
-             * @param {?} t
-             * @return {?}
-             */
-            (t) => new t());
+        const ownFactory = ownConstructor[NG_FACTORY_DEF] || ɵɵgetFactoryOf(ownConstructor);
+        /** @type {?} */
+        const objectPrototype = Object.prototype;
+        /** @type {?} */
+        let parent = Object.getPrototypeOf(type.prototype).constructor;
+        // Go up the prototype until we hit `Object`.
+        while (parent && parent !== objectPrototype) {
+            /** @type {?} */
+            const factory = parent[NG_FACTORY_DEF] || ɵɵgetFactoryOf(parent);
+            // If we hit something that has a factory and the factory isn't the same as the type,
+            // we've found the inherited factory. Note the check that the factory isn't the type's
+            // own factory is redundant in most cases, but if the user has custom decorators on the
+            // class, this lookup will start one level down in the prototype chain, causing us to
+            // find the own factory first and potentially triggering an infinite loop downstream.
+            if (factory && factory !== ownFactory) {
+                return factory;
+            }
+            parent = Object.getPrototypeOf(parent);
         }
+        // There is no factory defined. Either this was improper usage of inheritance
+        // (no Angular decorator on the superclass) or there is no constructor at all
+        // in the inheritance chain. Since the two cases cannot be distinguished, the
+        // latter has to be assumed.
+        return (/**
+         * @param {?} t
+         * @return {?}
+         */
+        t => new t());
     }));
 }
 
@@ -6632,6 +6645,11 @@ function enableProdMode() {
     if (_runModeLocked) {
         throw new Error('Cannot enable prod mode after platform setup.');
     }
+    // The below check is there so when ngDevMode is set via terser
+    // `global['ngDevMode'] = false;` is also dropped.
+    if (typeof ngDevMode === undefined || !!ngDevMode) {
+        _global['ngDevMode'] = false;
+    }
     _devMode = false;
 }
 
@@ -7654,6 +7672,42 @@ function getSanitizer() {
     return lView && lView[SANITIZER];
 }
 
+/**
+ * @license
+ * Copyright Google Inc. All Rights Reserved.
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.io/license
+ */
+const END_COMMENT = /-->/g;
+const END_COMMENT_ESCAPED = '-\u200B-\u200B>';
+/**
+ * Escape the content of the strings so that it can be safely inserted into a comment node.
+ *
+ * The issue is that HTML does not specify any way to escape comment end text inside the comment.
+ * `<!-- The way you close a comment is with "-->". -->`. Above the `"-->"` is meant to be text not
+ * an end to the comment. This can be created programmatically through DOM APIs.
+ *
+ * ```
+ * div.innerHTML = div.innerHTML
+ * ```
+ *
+ * One would expect that the above code would be safe to do, but it turns out that because comment
+ * text is not escaped, the comment may contain text which will prematurely close the comment
+ * opening up the application for XSS attack. (In SSR we programmatically create comment nodes which
+ * may contain such text and expect them to be safe.)
+ *
+ * This function escapes the comment text by looking for the closing char sequence `-->` and replace
+ * it with `-_-_>` where the `_` is a zero width space `\u200B`. The result is that if a comment
+ * contains `-->` text it will render normally but it will not cause the HTML parser to close the
+ * comment.
+ *
+ * @param value text to make safe for comment node by escaping the comment close character sequence
+ */
+function escapeCommentText(value) {
+    return value.replace(END_COMMENT, END_COMMENT_ESCAPED);
+}
+
 /**
  * @license
  * Copyright Google Inc. All Rights Reserved.
@@ -12711,7 +12765,7 @@ function setNgReflectProperty(lView, element, type, attrName, value) {
     }
     else {
         /** @type {?} */
-        const textContent = `bindings=${JSON.stringify({ [attrName]: debugValue }, null, 2)}`;
+        const textContent = escapeCommentText(`bindings=${JSON.stringify({ [attrName]: debugValue }, null, 2)}`);
         if (isProceduralRenderer(renderer)) {
             renderer.setValue(((/** @type {?} */ (element))), textContent);
         }
@@ -28169,7 +28223,7 @@ if (false) {
  * \@publicApi
  * @type {?}
  */
-const VERSION = new Version('9.1.9');
+const VERSION = new Version('9.1.13');
 
 /**
  * @fileoverview added by tsickle
@@ -47536,7 +47590,7 @@ function debugCheckAndUpdateNode(view, nodeDef, argStyle, givenValues) {
             const el = asElementData(view, elDef.nodeIndex).renderElement;
             if (!(/** @type {?} */ (elDef.element)).name) {
                 // a comment.
-                view.renderer.setValue(el, `bindings=${JSON.stringify(bindingValues, null, 2)}`);
+                view.renderer.setValue(el, escapeCommentText(`bindings=${JSON.stringify(bindingValues, null, 2)}`));
             }
             else {
                 // a regular element.
@@ -47960,7 +48014,7 @@ class DebugRenderer2 {
      */
     createComment(value) {
         /** @type {?} */
-        const comment = this.delegate.createComment(value);
+        const comment = this.delegate.createComment(escapeCommentText(value));
         /** @type {?} */
         const debugCtx = this.createDebugContext(comment);
         if (debugCtx) {