Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(ngStyle, ngClass): StyleDirective security fixes & merge activated styles #198

Merged
merged 1 commit into from
Feb 27, 2017

Conversation

ThomasBurleson
Copy link
Contributor

@ThomasBurleson ThomasBurleson commented Feb 25, 2017

  • Add use of DomSanitizer + SecurityContext.STYLE to safeguard all style values
  • Deprecated use of style selectors to favor ngStyle selectors since the functionality extends NgStyle directive.
  • Deprecated use of class selectors to favor ngClass selectors since the functionality extends NgClass directive.
  • ngStyle restores default (non-activated) inline styles when breakpoint deactivates
  • ngStyle merges default inline styles with activated styles
  • ngStyle selectors support Object notations or raw strings (ala html inline styles)
    • e.g. Object notation = [ngStyle]="{'font-size.px': 10, color: 'rgb(0,0,0)', 'text-align':'left'}"
    • e.g. Raw-string notation = style="font-size:10px; color:black; text-align:left;"
    • NOTE: delimiters for raw-strings must be ;.
  • Add support to ngStyle for all NgStyleType type variations
    • Added style-transforms.ts utilities and tests
    • Refactored _buildStyleMap() method

BREAKING CHANGE:

  • [style.<alias>] selectors are deprecated in favor of [ngStyle.<alias>] selectors
  • [class.<alias>] selectors are deprecated in favor of [ngClass.<alias>] selectors
  • default styles are merged with activated styles
<div  fxLayout
  [class.xs]="['xs-1', 'xs-2']"
  style="font-size:10px; color:black; text-align:left;"
  [style.xs]="{'font-size': '16px'}"
  [style.md]="{'font-size': '12px'}">
</div>
<div  fxLayout
  [ngClass.xs]="['xs-1', 'xs-2']"
  ngStyle="font-size:10px; color:black; text-align:left;"
  [ngStyle.xs]="{'font-size': '16px'}"
  [ngStyle.md]="{'font-size': '12px'}">
</div>

Fixes #197.

@ThomasBurleson ThomasBurleson force-pushed the fix/issue_197 branch 3 times, most recently from 9fe217f to 7207c0d Compare February 25, 2017 22:31
@ThomasBurleson ThomasBurleson changed the title fix(style): StyleDirective should merge styles instead of overwriting all existing fix(ngStyle, ngClass): style directive should merge styles instead of overwriting all existing Feb 25, 2017
@ThomasBurleson ThomasBurleson force-pushed the fix/issue_197 branch 2 times, most recently from 71b2007 to ae35afa Compare February 25, 2017 22:36
@ThomasBurleson ThomasBurleson force-pushed the fix/issue_197 branch 5 times, most recently from b7d0402 to 340e42d Compare February 26, 2017 23:05
@ThomasBurleson ThomasBurleson changed the title fix(ngStyle, ngClass): style directive should merge styles instead of overwriting all existing fix(ngStyle, ngClass): StyleDirective security fixes & merge activated styles Feb 26, 2017
@ThomasBurleson ThomasBurleson force-pushed the fix/issue_197 branch 11 times, most recently from 121cb7a to d2715e4 Compare February 27, 2017 15:01
…d styles

* Add use of **DomSanitizer** + **SecurityContext.STYLE** to safeguard all style values
* Deprecated use of `style` selectors to favor `ngStyle` selectors since the functionality extends **NgStyle** directive.
* Deprecated use of `class` selectors to favor `ngClass` selectors since the functionality extends **NgClass** directive.
* `ngStyle` restores default (non-activated) inline styles when breakpoint deactivates
* `ngStyle` merges default inline styles with activated styles
* `ngStyle` selectors support Object notations or raw strings (ala html inline styles)
  *  e.g. Object notation = `[ngStyle]="{'font-size.px': 10, color: 'rgb(0,0,0)', 'text-align':'left'}"`
  *  e.g. Raw-string notation = `style="font-size:10px; color:black; text-align:left;"`
    *  NOTE: delimiters for raw-strings must be `;`.
* Add support to ngStyle for all **NgStyleType** type variations
  *  Added `style-transforms.ts` utilities and tests
  *  Refactored `_buildStyleMap()` method

BREAKING CHANGE:

* `[style.<alias>]` selectors are deprecated in favor of `[ngStyle.<alias>]` selectors
* `[class.<alias>]` selectors are deprecated in favor of `[ngClass.<alias>]` selectors
* default styles are merged with activated styles

```html
<div  fxLayout
  [class.xs]="['xs-1', 'xs-2']"
  [style]="{'font-size': '10px', 'margin-left' : '13px'}"
  [style.xs]="{'font-size': '16px'}"
  [style.md]="{'font-size': '12px'}">
</div>
```

```html
<div  fxLayout
  [ngClass.xs]="['xs-1', 'xs-2']"
  [ngStyle]="{'font-size': '10px', 'margin-left' : '13px'}"
  [ngStyle.xs]="{'font-size': '16px'}"
  [ngStyle.md]="{'font-size': '12px'}">
</div>
```

Fixes #197.
@kara kara added pr: merge ready This PR is ready for the caretaker to presubmit and merge and removed pr: needs presubmit labels Feb 27, 2017
@kara kara merged commit eb22fe5 into master Feb 27, 2017
@ThomasBurleson ThomasBurleson deleted the fix/issue_197 branch March 4, 2017 22:54
karlhaas pushed a commit to karlhaas/flex-layout that referenced this pull request May 3, 2017
…d styles (angular#198)

BREAKING CHANGE:

* `[style.<alias>]` selectors are deprecated in favor of `[ngStyle.<alias>]` selectors
* `[class.<alias>]` selectors are deprecated in favor of `[ngClass.<alias>]` selectors
* default styles are merged with activated styles

```html
<div  fxLayout
  [class.xs]="['xs-1', 'xs-2']"
  [style]="{'font-size': '10px', 'margin-left' : '13px'}"
  [style.xs]="{'font-size': '16px'}"
  [style.md]="{'font-size': '12px'}">
</div>
```

```html
<div  fxLayout
  [ngClass.xs]="['xs-1', 'xs-2']"
  [ngStyle]="{'font-size': '10px', 'margin-left' : '13px'}"
  [ngStyle.xs]="{'font-size': '16px'}"
  [ngStyle.md]="{'font-size': '12px'}">
</div>
```

Fixes angular#197.
@angular-automatic-lock-bot
Copy link

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot bot locked and limited conversation to collaborators Sep 5, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
cla: yes pr: merge ready This PR is ready for the caretaker to presubmit and merge
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Responsive Style directive overwrites inline styles
3 participants