Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(core): hardening rules related to the attribute order on <iframe> elements #47935

Closed
wants to merge 1 commit into from
Closed

fix(core): hardening rules related to the attribute order on <iframe> elements #47935

wants to merge 1 commit into from

Conversation

AndrewKushnir
Copy link
Contributor

This commit updates the logic related to the attribute order on <iframe>s and makes the rules more strict. There is a set of <iframe> attributes that may affect the behavior of an <iframe>, this change enforces that these attributes are applied before an src or srcdoc attributes are applied to an <iframe>, so that they are taken into account.

If Angular detects that some of the attributes are set after the src or srcdoc, it throws an error message, which contains the name of an attribute that is causing the problem and the name of a Component where an <iframe> is located. In most cases, it should be enough to change the order of attributes in a template to move the src or srcdoc ones to the very end.

PR Type

What kind of change does this PR introduce?

  • Bugfix

Does this PR introduce a breaking change?

  • Yes
  • No

@AndrewKushnir AndrewKushnir added state: WIP area: core Issues related to the framework runtime target: rc This PR is targeted for the next release-candidate labels Nov 1, 2022
@ngbot ngbot bot modified the milestone: Backlog Nov 1, 2022
@AndrewKushnir AndrewKushnir force-pushed the attr_order_hybrid branch 2 times, most recently from 4b7207c to 5d36cbe Compare November 1, 2022 23:38
@AndrewKushnir
Copy link
Contributor Author

Presubmit.

Note: this PR would also require a TGP.

@AndrewKushnir AndrewKushnir added action: review The PR is still awaiting reviews from at least one requested reviewer and removed state: WIP labels Nov 1, 2022
@AndrewKushnir AndrewKushnir marked this pull request as ready for review November 1, 2022 23:47
@AndrewKushnir AndrewKushnir added the action: global presubmit The PR is in need of a google3 global presubmit label Nov 1, 2022
@AndrewKushnir
Copy link
Contributor Author

TGP.

@alxhub alxhub force-pushed the attr_order_hybrid branch 2 times, most recently from 135e9aa to daa70fb Compare November 2, 2022 10:15
alxhub
alxhub approved these changes Nov 2, 2022
View reviewed changes
Copy link
Member

@alxhub alxhub left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed-for: fw-core,fw-security,public-api,size-tracking

pkozlowski-opensource
pkozlowski-opensource approved these changes Nov 2, 2022
View reviewed changes
Copy link
Member

@pkozlowski-opensource pkozlowski-opensource left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Reviewed-for: public-api
Reviewed-for: size-tracking
Reviewed-for: fw-core
Reviewed-for: fw-security

@alxhub alxhub added action: merge The PR is ready for merge by the caretaker and removed action: review The PR is still awaiting reviews from at least one requested reviewer labels Nov 2, 2022
@AndrewKushnir @alxhub
fix(core): hardening rules related to the attribute order on iframe e…
b6795c1 
…lements

This commit updates the logic related to the attribute order on iframes and makes the rules more strict. There is a set of iframe attributes that may affect the behavior of an iframe, this change enforces that these attributes are applied before an `src` or `srcdoc` attributes are applied to an iframe, so that they are taken into account.

If Angular detects that some of the attributes are set after the `src` or `srcdoc`, it throws an error message, which contains the name of ann attribute that is causing the problem and the name of a Component where an iframe is located. In most cases, it should be enough to change the order of attributes in a template to move the `src` or `srcdoc` ones to the very end.

BREAKING CHANGE:

Existing iframe usages may have `src` or `srcdoc` preceding other attributes. Such usages may need to be updated to ensure compliance with the new stricter rules around iframe bindings.
@angular-robot angular-robot bot added the detected: breaking change PR contains a commit with a breaking change label Nov 2, 2022
alxhub pushed a commit that referenced this pull request Nov 2, 2022
@AndrewKushnir @alxhub
fix(core): hardening rules related to the attribute order on iframe e…
d4b3c0b 
…lements (#47935)

This commit updates the logic related to the attribute order on iframes and makes the rules more strict. There is a set of iframe attributes that may affect the behavior of an iframe, this change enforces that these attributes are applied before an `src` or `srcdoc` attributes are applied to an iframe, so that they are taken into account.

If Angular detects that some of the attributes are set after the `src` or `srcdoc`, it throws an error message, which contains the name of ann attribute that is causing the problem and the name of a Component where an iframe is located. In most cases, it should be enough to change the order of attributes in a template to move the `src` or `srcdoc` ones to the very end.

BREAKING CHANGE:

Existing iframe usages may have `src` or `srcdoc` preceding other attributes. Such usages may need to be updated to ensure compliance with the new stricter rules around iframe bindings.

PR Close #47935
@alxhub alxhub added target: minor This PR is targeted for the next minor release and removed target: rc This PR is targeted for the next release-candidate labels Nov 2, 2022
pkozlowski-opensource
pkozlowski-opensource approved these changes Nov 2, 2022
View reviewed changes
Copy link
Member

@pkozlowski-opensource pkozlowski-opensource left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Reviewed-for: public-api
Reviewed-for: size-tracking
Reviewed-for: fw-core
Reviewed-for: fw-security

@alxhub
Copy link
Member

alxhub commented Nov 2, 2022

This PR was merged into the repository by commit 2d08965.

@alxhub alxhub closed this in 2d08965 Nov 2, 2022
@AndrewKushnir AndrewKushnir removed the action: global presubmit The PR is in need of a google3 global presubmit label Nov 2, 2022
AndrewKushnir added a commit to AndrewKushnir/angular that referenced this pull request Nov 2, 2022
@AndrewKushnir
fix(core): hardening rules related to the attribute order on iframe e…
3ff569d 
…lements (angular#47935)

This commit updates the logic related to the attribute order on iframes and makes the rules more strict. There is a set of iframe attributes that may affect the behavior of an iframe, this change enforces that these attributes are applied before an `src` or `srcdoc` attributes are applied to an iframe, so that they are taken into account.

If Angular detects that some of the attributes are set after the `src` or `srcdoc`, it throws an error message, which contains the name of ann attribute that is causing the problem and the name of a Component where an iframe is located. In most cases, it should be enough to change the order of attributes in a template to move the `src` or `srcdoc` ones to the very end.

BREAKING CHANGE:

Existing iframe usages may have `src` or `srcdoc` preceding other attributes. Such usages may need to be updated to ensure compliance with the new stricter rules around iframe bindings.
AndrewKushnir added a commit to AndrewKushnir/angular that referenced this pull request Nov 2, 2022
@AndrewKushnir
fix(core): hardening rules related to the attribute order on iframe e…
ae30c09 
…lements (angular#47935)

This commit updates the logic related to the attribute order on iframes and makes the rules more strict. There is a set of iframe attributes that may affect the behavior of an iframe, this change enforces that these attributes are applied before an `src` or `srcdoc` attributes are applied to an iframe, so that they are taken into account.

If Angular detects that some of the attributes are set after the `src` or `srcdoc`, it throws an error message, which contains the name of ann attribute that is causing the problem and the name of a Component where an iframe is located. In most cases, it should be enough to change the order of attributes in a template to move the `src` or `srcdoc` ones to the very end.

BREAKING CHANGE:

Existing iframe usages may have `src` or `srcdoc` preceding other attributes. Such usages may need to be updated to ensure compliance with the new stricter rules around iframe bindings.

PR Close angular#47935
AndrewKushnir added a commit to AndrewKushnir/angular that referenced this pull request Nov 3, 2022
@AndrewKushnir
fix(core): hardening rules related to the attribute order on iframe e…
9712c79 
…lements (angular#47935)

This commit updates the logic related to the attribute order on iframes and makes the rules more strict. There is a set of iframe attributes that may affect the behavior of an iframe, this change enforces that these attributes are applied before an `src` or `srcdoc` attributes are applied to an iframe, so that they are taken into account.

If Angular detects that some of the attributes are set after the `src` or `srcdoc`, it throws an error message, which contains the name of ann attribute that is causing the problem and the name of a Component where an iframe is located. In most cases, it should be enough to change the order of attributes in a template to move the `src` or `srcdoc` ones to the very end.

BREAKING CHANGE:

Existing iframe usages may have `src` or `srcdoc` preceding other attributes. Such usages may need to be updated to ensure compliance with the new stricter rules around iframe bindings.

PR Close angular#47935
This was referenced Nov 3, 2022
Merged
Merged
AndrewKushnir added a commit to AndrewKushnir/angular that referenced this pull request Nov 3, 2022
@AndrewKushnir
fix(core): hardening rules related to the attribute order on iframe e…
f38ca0f 
…lements (angular#47935)

This commit updates the logic related to the attribute order on iframes and makes the rules more strict. There is a set of iframe attributes that may affect the behavior of an iframe, this change enforces that these attributes are applied before an `src` or `srcdoc` attributes are applied to an iframe, so that they are taken into account.

If Angular detects that some of the attributes are set after the `src` or `srcdoc`, it throws an error message, which contains the name of ann attribute that is causing the problem and the name of a Component where an iframe is located. In most cases, it should be enough to change the order of attributes in a template to move the `src` or `srcdoc` ones to the very end.

BREAKING CHANGE:

Existing iframe usages may have `src` or `srcdoc` preceding other attributes. Such usages may need to be updated to ensure compliance with the new stricter rules around iframe bindings.
AndrewKushnir added a commit to AndrewKushnir/angular that referenced this pull request Nov 3, 2022
@AndrewKushnir
Revert "fix(core): hardening rules related to the attribute order on …
fe113ac 
…iframe elements (angular#47935)"

This reverts commit 2d08965.

The reason for revert is that we've identified some issues with implementation. The issues will get addressed soon and the fix would be re-submitted.
AndrewKushnir added a commit that referenced this pull request Nov 3, 2022
@AndrewKushnir
Revert "fix(core): hardening rules related to the attribute order on …
13b863a 
…iframe elements (#47935)" (#47959)

This reverts commit 2d08965.

The reason for revert is that we've identified some issues with implementation. The issues will get addressed soon and the fix would be re-submitted.

PR Close #47959
AndrewKushnir added a commit to AndrewKushnir/angular that referenced this pull request Nov 3, 2022
@AndrewKushnir
Revert "fix(core): hardening rules related to the attribute order on …
a5d96d8 
…iframe elements (angular#47935)"

This reverts commit d4b3c0b.
AndrewKushnir added a commit that referenced this pull request Nov 4, 2022
@AndrewKushnir
Revert "fix(core): hardening rules related to the attribute order on …
173dde7 
…iframe elements (#47935)" (#47961)

This reverts commit d4b3c0b.

PR Close #47961
AndrewKushnir added a commit to AndrewKushnir/angular that referenced this pull request Nov 4, 2022
@AndrewKushnir
fix(core): hardening rules related to the attribute order on iframe e…
19ce9eb 
…lements (angular#47935)

This commit updates the logic related to the attribute order on iframes and makes the rules more strict. There is a set of iframe attributes that may affect the behavior of an iframe, this change enforces that these attributes are applied before an `src` or `srcdoc` attributes are applied to an iframe, so that they are taken into account.

If Angular detects that some of the attributes are set after the `src` or `srcdoc`, it throws an error message, which contains the name of ann attribute that is causing the problem and the name of a Component where an iframe is located. In most cases, it should be enough to change the order of attributes in a template to move the `src` or `srcdoc` ones to the very end.

BREAKING CHANGE:

Existing iframe usages may have `src` or `srcdoc` preceding other attributes. Such usages may need to be updated to ensure compliance with the new stricter rules around iframe bindings.

PR Close angular#47935
nouraellm pushed a commit to nouraellm/angular that referenced this pull request Nov 6, 2022
@AndrewKushnir @nouraellm
fix(core): hardening rules related to the attribute order on iframe e…
acbe854 
…lements (angular#47935)

This commit updates the logic related to the attribute order on iframes and makes the rules more strict. There is a set of iframe attributes that may affect the behavior of an iframe, this change enforces that these attributes are applied before an `src` or `srcdoc` attributes are applied to an iframe, so that they are taken into account.

If Angular detects that some of the attributes are set after the `src` or `srcdoc`, it throws an error message, which contains the name of ann attribute that is causing the problem and the name of a Component where an iframe is located. In most cases, it should be enough to change the order of attributes in a template to move the `src` or `srcdoc` ones to the very end.

BREAKING CHANGE:

Existing iframe usages may have `src` or `srcdoc` preceding other attributes. Such usages may need to be updated to ensure compliance with the new stricter rules around iframe bindings.

PR Close angular#47935
nouraellm pushed a commit to nouraellm/angular that referenced this pull request Nov 6, 2022
@AndrewKushnir @nouraellm
Revert "fix(core): hardening rules related to the attribute order on …
9617fb7 
…iframe elements (angular#47935)" (angular#47959)

This reverts commit 2d08965.

The reason for revert is that we've identified some issues with implementation. The issues will get addressed soon and the fix would be re-submitted.

PR Close angular#47959
@angular-automatic-lock-bot
Copy link

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot bot locked and limited conversation to collaborators Dec 3, 2022
trekladyone pushed a commit to trekladyone/angular that referenced this pull request Feb 1, 2023
@AndrewKushnir @trekladyone
fix(core): hardening rules related to the attribute order on iframe e…
96099f3 
…lements (angular#47935)

This commit updates the logic related to the attribute order on iframes and makes the rules more strict. There is a set of iframe attributes that may affect the behavior of an iframe, this change enforces that these attributes are applied before an `src` or `srcdoc` attributes are applied to an iframe, so that they are taken into account.

If Angular detects that some of the attributes are set after the `src` or `srcdoc`, it throws an error message, which contains the name of ann attribute that is causing the problem and the name of a Component where an iframe is located. In most cases, it should be enough to change the order of attributes in a template to move the `src` or `srcdoc` ones to the very end.

BREAKING CHANGE:

Existing iframe usages may have `src` or `srcdoc` preceding other attributes. Such usages may need to be updated to ensure compliance with the new stricter rules around iframe bindings.

PR Close angular#47935
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@pkozlowski-opensource pkozlowski-opensource pkozlowski-opensource approved these changes

@alxhub alxhub alxhub approved these changes

Assignees
No one assigned
Labels
action: merge The PR is ready for merge by the caretaker area: core Issues related to the framework runtime detected: breaking change PR contains a commit with a breaking change target: minor This PR is targeted for the next minor release
Projects
None yet
Milestone
Backlog
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@AndrewKushnir @alxhub @pkozlowski-opensource