@angular/core 9.1.9 → 9.1.13

package/fesm2015/testing.js

@@ -1,5 +1,5 @@
 /**
- * @license Angular v9.1.9
+ * @license Angular v9.1.13
  * (c) 2010-2020 Google LLC. https://angular.io/
  * License: MIT
  */

package/fesm5/core.js

@@ -1,5 +1,5 @@
 /**
- * @license Angular v9.1.9
+ * @license Angular v9.1.13
  * (c) 2010-2020 Google LLC. https://angular.io/
  * License: MIT
  */
@@ -4057,18 +4057,28 @@ function ɵɵgetFactoryOf(type) {
  */
 function ɵɵgetInheritedFactory(type) {
     return noSideEffects(function () {
-        var proto = Object.getPrototypeOf(type.prototype).constructor;
-        var factory = proto[NG_FACTORY_DEF] || ɵɵgetFactoryOf(proto);
-        if (factory !== null) {
-            return factory;
-        }
-        else {
-            // There is no factory defined. Either this was improper usage of inheritance
-            // (no Angular decorator on the superclass) or there is no constructor at all
-            // in the inheritance chain. Since the two cases cannot be distinguished, the
-            // latter has to be assumed.
-            return function (t) { return new t(); };
-        }
+        var ownConstructor = type.prototype.constructor;
+        var ownFactory = ownConstructor[NG_FACTORY_DEF] || ɵɵgetFactoryOf(ownConstructor);
+        var objectPrototype = Object.prototype;
+        var parent = Object.getPrototypeOf(type.prototype).constructor;
+        // Go up the prototype until we hit `Object`.
+        while (parent && parent !== objectPrototype) {
+            var factory = parent[NG_FACTORY_DEF] || ɵɵgetFactoryOf(parent);
+            // If we hit something that has a factory and the factory isn't the same as the type,
+            // we've found the inherited factory. Note the check that the factory isn't the type's
+            // own factory is redundant in most cases, but if the user has custom decorators on the
+            // class, this lookup will start one level down in the prototype chain, causing us to
+            // find the own factory first and potentially triggering an infinite loop downstream.
+            if (factory && factory !== ownFactory) {
+                return factory;
+            }
+            parent = Object.getPrototypeOf(parent);
+        }
+        // There is no factory defined. Either this was improper usage of inheritance
+        // (no Angular decorator on the superclass) or there is no constructor at all
+        // in the inheritance chain. Since the two cases cannot be distinguished, the
+        // latter has to be assumed.
+        return function (t) { return new t(); };
     });
 }
 
@@ -4402,6 +4412,11 @@ function enableProdMode() {
     if (_runModeLocked) {
         throw new Error('Cannot enable prod mode after platform setup.');
     }
+    // The below check is there so when ngDevMode is set via terser
+    // `global['ngDevMode'] = false;` is also dropped.
+    if (typeof ngDevMode === undefined || !!ngDevMode) {
+        _global['ngDevMode'] = false;
+    }
     _devMode = false;
 }
 
@@ -5230,6 +5245,42 @@ function getSanitizer() {
     return lView && lView[SANITIZER];
 }
 
+/**
+ * @license
+ * Copyright Google Inc. All Rights Reserved.
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.io/license
+ */
+var END_COMMENT = /-->/g;
+var END_COMMENT_ESCAPED = '-\u200B-\u200B>';
+/**
+ * Escape the content of the strings so that it can be safely inserted into a comment node.
+ *
+ * The issue is that HTML does not specify any way to escape comment end text inside the comment.
+ * `<!-- The way you close a comment is with "-->". -->`. Above the `"-->"` is meant to be text not
+ * an end to the comment. This can be created programmatically through DOM APIs.
+ *
+ * ```
+ * div.innerHTML = div.innerHTML
+ * ```
+ *
+ * One would expect that the above code would be safe to do, but it turns out that because comment
+ * text is not escaped, the comment may contain text which will prematurely close the comment
+ * opening up the application for XSS attack. (In SSR we programmatically create comment nodes which
+ * may contain such text and expect them to be safe.)
+ *
+ * This function escapes the comment text by looking for the closing char sequence `-->` and replace
+ * it with `-_-_>` where the `_` is a zero width space `\u200B`. The result is that if a comment
+ * contains `-->` text it will render normally but it will not cause the HTML parser to close the
+ * comment.
+ *
+ * @param value text to make safe for comment node by escaping the comment close character sequence
+ */
+function escapeCommentText(value) {
+    return value.replace(END_COMMENT, END_COMMENT_ESCAPED);
+}
+
 /**
  * @license
  * Copyright Google Inc. All Rights Reserved.
@@ -8195,7 +8246,7 @@ function setNgReflectProperty(lView, element, type, attrName, value) {
         }
     }
     else {
-        var textContent = "bindings=" + JSON.stringify((_a = {}, _a[attrName] = debugValue, _a), null, 2);
+        var textContent = escapeCommentText("bindings=" + JSON.stringify((_a = {}, _a[attrName] = debugValue, _a), null, 2));
         if (isProceduralRenderer(renderer)) {
             renderer.setValue(element, textContent);
         }
@@ -20049,7 +20100,7 @@ var Version = /** @class */ (function () {
 /**
  * @publicApi
  */
-var VERSION = new Version('9.1.9');
+var VERSION = new Version('9.1.13');
 
 /**
  * @license
@@ -32114,7 +32165,7 @@ function debugCheckAndUpdateNode(view, nodeDef, argStyle, givenValues) {
             var el = asElementData(view, elDef.nodeIndex).renderElement;
             if (!elDef.element.name) {
                 // a comment.
-                view.renderer.setValue(el, "bindings=" + JSON.stringify(bindingValues, null, 2));
+                view.renderer.setValue(el, escapeCommentText("bindings=" + JSON.stringify(bindingValues, null, 2)));
             }
             else {
                 // a regular element.
@@ -32403,7 +32454,7 @@ var DebugRenderer2 = /** @class */ (function () {
         return el;
     };
     DebugRenderer2.prototype.createComment = function (value) {
-        var comment = this.delegate.createComment(value);
+        var comment = this.delegate.createComment(escapeCommentText(value));
         var debugCtx = this.createDebugContext(comment);
         if (debugCtx) {
             indexDebugNode(new DebugNode__PRE_R3__(comment, null, debugCtx));