()
| 18457 | /* jshint maxlen: 100 */ |
| 18458 | |
| 18459 | function $SceProvider() { |
| 18460 | var enabled = true; |
| 18461 | |
| 18462 | /** |
| 18463 | * @ngdoc method |
| 18464 | * @name $sceProvider#enabled |
| 18465 | * @kind function |
| 18466 | * |
| 18467 | * @param {boolean=} value If provided, then enables/disables SCE. |
| 18468 | * @return {boolean} true if SCE is enabled, false otherwise. |
| 18469 | * |
| 18470 | * @description |
| 18471 | * Enables/disables SCE and returns the current value. |
| 18472 | */ |
| 18473 | this.enabled = function (value) { |
| 18474 | if (arguments.length) { |
| 18475 | enabled = !!value; |
| 18476 | } |
| 18477 | return enabled; |
| 18478 | }; |
| 18479 | |
| 18480 | /* Design notes on the default implementation for SCE. |
| 18481 | * |
| 18482 | * The API contract for the SCE delegate |
| 18483 | * ------------------------------------- |
| 18484 | * The SCE delegate object must provide the following 3 methods: |
| 18485 | * |
| 18486 | * - trustAs(contextEnum, value) |
| 18487 | * This method is used to tell the SCE service that the provided value is OK to use in the |
| 18488 | * contexts specified by contextEnum. It must return an object that will be accepted by |
| 18489 | * getTrusted() for a compatible contextEnum and return this value. |
| 18490 | * |
| 18491 | * - valueOf(value) |
| 18492 | * For values that were not produced by trustAs(), return them as is. For values that were |
| 18493 | * produced by trustAs(), return the corresponding input value to trustAs. Basically, if |
| 18494 | * trustAs is wrapping the given values into some type, this operation unwraps it when given |
| 18495 | * such a value. |
| 18496 | * |
| 18497 | * - getTrusted(contextEnum, value) |
| 18498 | * This function should return the a value that is safe to use in the context specified by |
| 18499 | * contextEnum or throw and exception otherwise. |
| 18500 | * |
| 18501 | * NOTE: This contract deliberately does NOT state that values returned by trustAs() must be |
| 18502 | * opaque or wrapped in some holder object. That happens to be an implementation detail. For |
| 18503 | * instance, an implementation could maintain a registry of all trusted objects by context. In |
| 18504 | * such a case, trustAs() would return the same object that was passed in. getTrusted() would |
| 18505 | * return the same object passed in if it was found in the registry under a compatible context or |
| 18506 | * throw an exception otherwise. An implementation might only wrap values some of the time based |
| 18507 | * on some criteria. getTrusted() might return a value and not throw an exception for special |
| 18508 | * constants or objects even if not wrapped. All such implementations fulfill this contract. |
| 18509 | * |
| 18510 | * |
| 18511 | * A note on the inheritance model for SCE contexts |
| 18512 | * ------------------------------------------------ |
| 18513 | * I've used inheritance and made RESOURCE_URL wrapped types a subtype of URL wrapped types. This |
| 18514 | * is purely an implementation details. |
| 18515 | * |
| 18516 | * The contract is simply this: |
nothing calls this directly
no test coverage detected