* @ngdoc service * @name $sce * @kind function * * @description * * `$sce` is a service that provides Strict Contextual Escaping services to AngularJS. * * # Strict Contextual Escaping * * Strict Contextual Escaping (SCE) is a mode in which AngularJS requires bindings in certain * context
()
| 19165 | */ |
| 19166 | |
| 19167 | function $SceProvider() { |
| 19168 | var enabled = true; |
| 19169 | |
| 19170 | /** |
| 19171 | * @ngdoc method |
| 19172 | * @name $sceProvider#enabled |
| 19173 | * @kind function |
| 19174 | * |
| 19175 | * @param {boolean=} value If provided, then enables/disables SCE. |
| 19176 | * @return {boolean} true if SCE is enabled, false otherwise. |
| 19177 | * |
| 19178 | * @description |
| 19179 | * Enables/disables SCE and returns the current value. |
| 19180 | */ |
| 19181 | this.enabled = function(value) { |
| 19182 | if (arguments.length) { |
| 19183 | enabled = !!value; |
| 19184 | } |
| 19185 | return enabled; |
| 19186 | }; |
| 19187 | |
| 19188 | |
| 19189 | /* Design notes on the default implementation for SCE. |
| 19190 | * |
| 19191 | * The API contract for the SCE delegate |
| 19192 | * ------------------------------------- |
| 19193 | * The SCE delegate object must provide the following 3 methods: |
| 19194 | * |
| 19195 | * - trustAs(contextEnum, value) |
| 19196 | * This method is used to tell the SCE service that the provided value is OK to use in the |
| 19197 | * contexts specified by contextEnum. It must return an object that will be accepted by |
| 19198 | * getTrusted() for a compatible contextEnum and return this value. |
| 19199 | * |
| 19200 | * - valueOf(value) |
| 19201 | * For values that were not produced by trustAs(), return them as is. For values that were |
| 19202 | * produced by trustAs(), return the corresponding input value to trustAs. Basically, if |
| 19203 | * trustAs is wrapping the given values into some type, this operation unwraps it when given |
| 19204 | * such a value. |
| 19205 | * |
| 19206 | * - getTrusted(contextEnum, value) |
| 19207 | * This function should return the a value that is safe to use in the context specified by |
| 19208 | * contextEnum or throw and exception otherwise. |
| 19209 | * |
| 19210 | * NOTE: This contract deliberately does NOT state that values returned by trustAs() must be |
| 19211 | * opaque or wrapped in some holder object. That happens to be an implementation detail. For |
| 19212 | * instance, an implementation could maintain a registry of all trusted objects by context. In |
| 19213 | * such a case, trustAs() would return the same object that was passed in. getTrusted() would |
| 19214 | * return the same object passed in if it was found in the registry under a compatible context or |
| 19215 | * throw an exception otherwise. An implementation might only wrap values some of the time based |
| 19216 | * on some criteria. getTrusted() might return a value and not throw an exception for special |
| 19217 | * constants or objects even if not wrapped. All such implementations fulfill this contract. |
| 19218 | * |
| 19219 | * |
| 19220 | * A note on the inheritance model for SCE contexts |
| 19221 | * ------------------------------------------------ |
| 19222 | * I've used inheritance and made RESOURCE_URL wrapped types a subtype of URL wrapped types. This |
| 19223 | * is purely an implementation details. |
| 19224 | * |
nothing calls this directly
no test coverage detected