angular.js/test/ng
Chirayu Krishnappa 3d6a89e888 feat($parse): secure expressions by hiding "private" properties
BREAKING CHANGE:
This commit introduces the notion of "private" properties (properties
whose names begin and/or end with an underscore) on the scope chain.
These properties will not be available to Angular expressions (i.e. {{
}} interpolation in templates and strings passed to `$parse`)  They are
freely available to JavaScript code (as before).

Motivation
----------
Angular expressions execute in a limited context.  They do not have
direct access to the global scope, Window, Document or the Function
constructor.  However, they have direct access to names/properties on
the scope chain.  It has been a long standing best practice to keep
sensitive APIs outside of the scope chain (in a closure or your
controller.)  That's easier said that done for two reasons: (1)
JavaScript does not have a notion of private properties so if you need
someone on the scope chain for JavaScript use, you also expose it to
Angular expressions, and (2) the new "controller as" syntax that's now
in increased usage exposes the entire controller on the scope chain
greatly increaing the exposed surface.  Though Angular expressions are
written and controlled by the developer, they (1) typically deal with
user input and (2) don't get the kind of test coverage that JavaScript
code would.  This commit provides a way, via a naming convention, to
allow publishing/restricting properties from controllers/scopes to
Angular expressions enabling one to only expose those properties that
are actually needed by the expressions.
2013-10-30 17:01:51 -07:00
..
directive fix(ngIf): ngIf removes elements dynamically added to it 2013-10-30 16:21:02 -07:00
filter test(filters): fix timezone-dependent test 2013-10-09 10:18:51 -07:00
anchorScrollSpec.js fix($sniffer): report history false on Android < 4 2012-05-14 15:12:51 -07:00
animateSpec.js fix(jqLite): use get/setAttribute so that jqLite works on SVG nodes 2013-09-27 12:38:27 -07:00
browserSpecs.js fix($location): prevent infinite digest error in IE7 2013-10-02 15:33:31 -07:00
cacheFactorySpec.js feat(minerr): log minerr doc url in development 2013-08-15 13:23:18 -07:00
compileSpec.js fix($compile): don't instantiate controllers twice for element transclude directives 2013-10-28 01:11:18 -07:00
controllerSpec.js fix(*): protect calls to hasOwnProperty in public API 2013-10-07 09:01:13 -07:00
documentSpec.js chore(module): move files around in preparation for more modules 2012-03-28 11:16:35 -07:00
exceptionHandlerSpec.js chore(module): move files around in preparation for more modules 2012-03-28 11:16:35 -07:00
filterSpec.js feat(filter): allow map of filters to be registered 2013-10-01 10:26:36 +01:00
httpBackendSpec.js refactor(location): $location now uses urlUtils, not RegEx 2013-10-10 11:41:07 -07:00
httpSpec.js fix($http): allow empty responses to be cached 2013-09-02 11:47:51 +02:00
interpolateSpec.js feat(minerr): log minerr doc url in development 2013-08-15 13:23:18 -07:00
intervalSpec.js feat($interval): add a service wrapping setInterval 2013-10-07 13:45:40 -07:00
localeSpec.js chore(module): move files around in preparation for more modules 2012-03-28 11:16:35 -07:00
locationSpec.js refactor(location): $location now uses urlUtils, not RegEx 2013-10-10 11:41:07 -07:00
logSpec.js fix(log): prevent logging undefined for $log in IE 2013-09-27 16:44:21 -07:00
parseSpec.js feat($parse): secure expressions by hiding "private" properties 2013-10-30 17:01:51 -07:00
qSpec.js style($qSpec): add semi-colons 2013-10-02 14:12:35 +01:00
rootElementSpec.js feat($rootElement): added application root element 2012-06-02 14:50:58 -07:00
rootScopeSpec.js fix(rootScope): make stopPropagation only stop its own event 2013-10-05 22:45:43 +01:00
sceSpecs.js test($sce): ie8 fix for entire file 2013-10-02 12:06:27 -07:00
snifferSpec.js fix(csp): fix csp auto-detection and stylesheet injection 2013-10-18 17:33:53 -07:00
timeoutSpec.js feat($interval): add a service wrapping setInterval 2013-10-07 13:45:40 -07:00
urlUtilsSpec.js refactor(location): $location now uses urlUtils, not RegEx 2013-10-10 11:41:07 -07:00
windowSpec.js chore(module): move files around in preparation for more modules 2012-03-28 11:16:35 -07:00