chore(all): prepare release 1.9.0

aurelia · Mar 27, 2019 · ef1d9e1 · ef1d9e1
1 parent e715b98
commit ef1d9e1
Show file tree

Hide file tree

Showing 28 changed files with 424 additions and 159 deletions.
diff --git a/bower.json b/bower.json
@@ -1,6 +1,6 @@
 {
   "name": "aurelia-templating-resources",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "A standard set of behaviors, converters and other resources for use with the Aurelia templating library.",
   "keywords": [
     "aurelia",

diff --git a/dist/amd/dynamic-element.js b/dist/amd/dynamic-element.js
@@ -1,4 +1,4 @@
-define(['exports', 'aurelia-templating'], function (exports, _aureliaTemplating) {
+define(['exports', 'aurelia-templating', 'aurelia-logging'], function (exports, _aureliaTemplating, _aureliaLogging) {
   'use strict';
 
   Object.defineProperty(exports, "__esModule", {
@@ -8,9 +8,13 @@ define(['exports', 'aurelia-templating'], function (exports, _aureliaTemplating)
 
 
 
-  function _createDynamicElement(name, viewUrl, bindableNames) {
+  function _createDynamicElement(_ref) {
     var _dec, _dec2, _class;
 
+    var name = _ref.name,
+        viewUrl = _ref.viewUrl,
+        bindableNames = _ref.bindableNames,
+        useShadowDOMmode = _ref.useShadowDOMmode;
     var DynamicElement = (_dec = (0, _aureliaTemplating.customElement)(name), _dec2 = (0, _aureliaTemplating.useView)(viewUrl), _dec(_class = _dec2(_class = function () {
       function DynamicElement() {
 
@@ -23,9 +27,32 @@ define(['exports', 'aurelia-templating'], function (exports, _aureliaTemplating)
       return DynamicElement;
     }()) || _class) || _class);
 
+
     for (var i = 0, ii = bindableNames.length; i < ii; ++i) {
       (0, _aureliaTemplating.bindable)(bindableNames[i])(DynamicElement);
     }
+
+    switch (useShadowDOMmode) {
+      case 'open':
+        (0, _aureliaTemplating.useShadowDOM)({ mode: 'open' })(DynamicElement);
+        break;
+
+      case 'closed':
+        (0, _aureliaTemplating.useShadowDOM)({ mode: 'closed' })(DynamicElement);
+        break;
+
+      case '':
+        (0, _aureliaTemplating.useShadowDOM)(DynamicElement);
+        break;
+
+      case null:
+        break;
+
+      default:
+        (0, _aureliaLogging.getLogger)('aurelia-html-only-element').warn('Expected \'use-shadow-dom\' value to be "close", "open" or "", received ' + useShadowDOMmode);
+        break;
+    }
+
     return DynamicElement;
   }
 });
diff --git a/dist/amd/html-resource-plugin.js b/dist/amd/html-resource-plugin.js
@@ -16,23 +16,24 @@ define(['exports', 'aurelia-templating', './dynamic-element'], function (exports
     var loader = config.aurelia.loader;
 
     viewEngine.addResourcePlugin('.html', {
-      'fetch': function fetch(address) {
-        return loader.loadTemplate(address).then(function (registryEntry) {
+      'fetch': function fetch(viewUrl) {
+        return loader.loadTemplate(viewUrl).then(function (registryEntry) {
           var _ref;
 
-          var bindable = registryEntry.template.getAttribute('bindable');
-          var elementName = getElementName(address);
+          var bindableNames = registryEntry.template.getAttribute('bindable');
+          var useShadowDOMmode = registryEntry.template.getAttribute('use-shadow-dom');
+          var name = getElementName(viewUrl);
 
-          if (bindable) {
-            bindable = bindable.split(',').map(function (x) {
+          if (bindableNames) {
+            bindableNames = bindableNames.split(',').map(function (x) {
               return x.trim();
             });
             registryEntry.template.removeAttribute('bindable');
           } else {
-            bindable = [];
+            bindableNames = [];
           }
 
-          return _ref = {}, _ref[elementName] = (0, _dynamicElement._createDynamicElement)(elementName, address, bindable), _ref;
+          return _ref = {}, _ref[name] = (0, _dynamicElement._createDynamicElement)({ name: name, viewUrl: viewUrl, bindableNames: bindableNames, useShadowDOMmode: useShadowDOMmode }), _ref;
         });
       }
     });

diff --git a/dist/amd/html-sanitizer.js b/dist/amd/html-sanitizer.js
@@ -1,9 +1,10 @@
-define(['exports'], function (exports) {
+define(['exports', 'aurelia-logging'], function (exports, _aureliaLogging) {
   'use strict';
 
   Object.defineProperty(exports, "__esModule", {
     value: true
   });
+  exports.HTMLSanitizer = undefined;
 
 
 
@@ -12,6 +13,8 @@ define(['exports'], function (exports) {
   var HTMLSanitizer = exports.HTMLSanitizer = function () {
     function HTMLSanitizer() {
 
+
+      (0, _aureliaLogging.getLogger)('html-sanitizer').warn('CAUTION: The default HTMLSanitizer does NOT provide security against a wide variety of sophisticated XSS attacks,\n      and should not be relied on for sanitizing input from unknown sources.\n      Please see https://aurelia.io/docs/binding/basics#element-content for instructions on how to use a secure solution like DOMPurify or sanitize-html.');
     }
 
     HTMLSanitizer.prototype.sanitize = function sanitize(input) {

diff --git a/dist/amd/signal-binding-behavior.js b/dist/amd/signal-binding-behavior.js
@@ -25,13 +25,17 @@ define(['exports', 'aurelia-binding', './binding-signaler'], function (exports,
       if (!binding.updateTarget) {
         throw new Error('Only property bindings and string interpolation bindings can be signaled.  Trigger, delegate and call bindings cannot be signaled.');
       }
-      if (arguments.length === 3) {
-        var name = arguments[2];
+
+      for (var _len = arguments.length, names = Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) {
+        names[_key - 2] = arguments[_key];
+      }
+
+      if (names.length === 1) {
+        var name = names[0];
         var bindings = this.signals[name] || (this.signals[name] = []);
         bindings.push(binding);
         binding.signalName = name;
-      } else if (arguments.length > 3) {
-        var names = Array.prototype.slice.call(arguments, 2);
+      } else if (names.length > 1) {
         var i = names.length;
         while (i--) {
           var _name = names[i];
@@ -48,10 +52,10 @@ define(['exports', 'aurelia-binding', './binding-signaler'], function (exports,
       var name = binding.signalName;
       binding.signalName = null;
       if (Array.isArray(name)) {
-        var names = name;
-        var i = names.length;
+        var _names = name;
+        var i = _names.length;
         while (i--) {
-          var n = names[i];
+          var n = _names[i];
           var bindings = this.signals[n];
           bindings.splice(bindings.indexOf(binding), 1);
         }

diff --git a/dist/aurelia-templating-resources.d.ts b/dist/aurelia-templating-resources.d.ts
@@ -11,6 +11,7 @@ import {
   useView,
   customElement,
   bindable,
+  useShadowDOM,
   ViewResources,
   resource,
   ViewCompileInstruction,
@@ -36,6 +37,9 @@ import {
   valueConverter,
   ObserverLocator
 } from 'aurelia-binding';
+import {
+  getLogger
+} from 'aurelia-logging';
 import {
   TaskQueue
 } from 'aurelia-task-queue';
@@ -198,6 +202,7 @@ export declare class IfCore {
 * Default Html Sanitizer to prevent script injection.
 */
 export declare class HTMLSanitizer {
+  constructor();
 
   /**
     * Sanitizes the provided input.
@@ -583,7 +588,7 @@ export declare class SignalBindingBehavior {
   static inject(): any;
   signals: any;
   constructor(bindingSignaler?: any);
-  bind(binding?: any, source?: any): any;
+  bind(binding?: any, source?: any, ...names: any[]): any;
   unbind(binding?: any, source?: any): any;
 }
 

diff --git a/dist/aurelia-templating-resources.js b/dist/aurelia-templating-resources.js
@@ -1,6 +1,7 @@
 import {inject,Container,Optional} from 'aurelia-dependency-injection';
-import {BoundViewFactory,ViewSlot,customAttribute,templateController,useView,customElement,bindable,ViewResources,resource,ViewCompileInstruction,CompositionEngine,CompositionContext,noView,View,ViewEngine,Animator,TargetInstruction} from 'aurelia-templating';
+import {BoundViewFactory,ViewSlot,customAttribute,templateController,useView,customElement,bindable,useShadowDOM,ViewResources,resource,ViewCompileInstruction,CompositionEngine,CompositionContext,noView,View,ViewEngine,Animator,TargetInstruction} from 'aurelia-templating';
 import {createOverrideContext,bindingMode,EventSubscriber,bindingBehavior,BindingBehavior,ValueConverter,sourceContext,targetContext,DataAttributeObserver,mergeSplice,valueConverter,ObserverLocator} from 'aurelia-binding';
+import {getLogger} from 'aurelia-logging';
 import {TaskQueue} from 'aurelia-task-queue';
 import {DOM,FEATURE} from 'aurelia-pal';
 import {Loader} from 'aurelia-loader';
@@ -463,6 +464,13 @@ const SCRIPT_REGEX = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
 * Default Html Sanitizer to prevent script injection.
 */
 export class HTMLSanitizer {
+  constructor() {
+    getLogger('html-sanitizer')
+      .warn(`CAUTION: The default HTMLSanitizer does NOT provide security against a wide variety of sophisticated XSS attacks,
+      and should not be relied on for sanitizing input from unknown sources.
+      Please see https://aurelia.io/docs/binding/basics#element-content for instructions on how to use a secure solution like DOMPurify or sanitize-html.`);
+  }
+
   /**
   * Sanitizes the provided input.
   * @param input The input to be sanitized.
@@ -549,17 +557,47 @@ export class Focus {
 }
 
 /*eslint padded-blocks:0*/
-export function _createDynamicElement(name: string, viewUrl: string, bindableNames: string[]): Function {
+export function _createDynamicElement({ name, viewUrl, bindableNames, useShadowDOMmode } : {
+  name: string,
+  viewUrl: string,
+  bindableNames: string[],
+  useShadowDOMmode: null | '' | 'open' | 'closed'
+}): Function {
   @customElement(name)
   @useView(viewUrl)
   class DynamicElement {
     bind(bindingContext) {
       this.$parent = bindingContext;
     }
   }
+
   for (let i = 0, ii = bindableNames.length; i < ii; ++i) {
     bindable(bindableNames[i])(DynamicElement);
   }
+
+  switch (useShadowDOMmode) {
+  case 'open':
+    useShadowDOM({ mode: 'open' })(DynamicElement);
+    break;
+
+  case 'closed':
+    useShadowDOM({ mode: 'closed' })(DynamicElement);
+    break;
+
+  case '':
+    useShadowDOM(DynamicElement);
+    break;
+
+  case null:
+    // Do not use shadow dom
+    break;
+
+  default:
+    getLogger('aurelia-html-only-element')
+      .warn(`Expected 'use-shadow-dom' value to be "close", "open" or "", received ${useShadowDOMmode}`);
+    break;
+  }
+
   return DynamicElement;
 }
 
@@ -1856,23 +1894,24 @@ export function getElementName(address) {
 }
 
 export function configure(config) {
-  let viewEngine = config.container.get(ViewEngine);
-  let loader = config.aurelia.loader;
+  const viewEngine = config.container.get(ViewEngine);
+  const loader = config.aurelia.loader;
 
   viewEngine.addResourcePlugin('.html', {
-    'fetch': function(address) {
-      return loader.loadTemplate(address).then(registryEntry => {
-        let bindable = registryEntry.template.getAttribute('bindable');
-        let elementName = getElementName(address);
-
-        if (bindable) {
-          bindable = bindable.split(',').map(x => x.trim());
+    'fetch': function(viewUrl) {
+      return loader.loadTemplate(viewUrl).then(registryEntry => {
+        let bindableNames = registryEntry.template.getAttribute('bindable');
+        const useShadowDOMmode: null | '' | 'open' | 'closed' = registryEntry.template.getAttribute('use-shadow-dom');
+        const name = getElementName(viewUrl);
+
+        if (bindableNames) {
+          bindableNames = bindableNames.split(',').map(x => x.trim());
           registryEntry.template.removeAttribute('bindable');
         } else {
-          bindable = [];
+          bindableNames = [];
         }
 
-        return { [elementName]: _createDynamicElement(elementName, address, bindable) };
+        return { [name]: _createDynamicElement({name, viewUrl, bindableNames, useShadowDOMmode}) };
       });
     }
   });
@@ -1887,17 +1926,16 @@ export class SignalBindingBehavior {
     this.signals = bindingSignaler.signals;
   }
 
-  bind(binding, source) {
+  bind(binding, source, ...names) {
     if (!binding.updateTarget) {
       throw new Error('Only property bindings and string interpolation bindings can be signaled.  Trigger, delegate and call bindings cannot be signaled.');
     }
-    if (arguments.length === 3) {
-      let name = arguments[2];
+    if (names.length === 1) {
+      let name = names[0];
       let bindings = this.signals[name] || (this.signals[name] = []);
       bindings.push(binding);
       binding.signalName = name;
-    } else if (arguments.length > 3) {
-      let names = Array.prototype.slice.call(arguments, 2);
+    } else if (names.length > 1) {
       let i = names.length;
       while (i--) {
         let name = names[i];

diff --git a/dist/commonjs/dynamic-element.js b/dist/commonjs/dynamic-element.js
@@ -7,11 +7,17 @@ exports._createDynamicElement = _createDynamicElement;
 
 var _aureliaTemplating = require('aurelia-templating');
 
+var _aureliaLogging = require('aurelia-logging');
 
 
-function _createDynamicElement(name, viewUrl, bindableNames) {
+
+function _createDynamicElement(_ref) {
   var _dec, _dec2, _class;
 
+  var name = _ref.name,
+      viewUrl = _ref.viewUrl,
+      bindableNames = _ref.bindableNames,
+      useShadowDOMmode = _ref.useShadowDOMmode;
   var DynamicElement = (_dec = (0, _aureliaTemplating.customElement)(name), _dec2 = (0, _aureliaTemplating.useView)(viewUrl), _dec(_class = _dec2(_class = function () {
     function DynamicElement() {
 
@@ -24,8 +30,31 @@ function _createDynamicElement(name, viewUrl, bindableNames) {
     return DynamicElement;
   }()) || _class) || _class);
 
+
   for (var i = 0, ii = bindableNames.length; i < ii; ++i) {
     (0, _aureliaTemplating.bindable)(bindableNames[i])(DynamicElement);
   }
+
+  switch (useShadowDOMmode) {
+    case 'open':
+      (0, _aureliaTemplating.useShadowDOM)({ mode: 'open' })(DynamicElement);
+      break;
+
+    case 'closed':
+      (0, _aureliaTemplating.useShadowDOM)({ mode: 'closed' })(DynamicElement);
+      break;
+
+    case '':
+      (0, _aureliaTemplating.useShadowDOM)(DynamicElement);
+      break;
+
+    case null:
+      break;
+
+    default:
+      (0, _aureliaLogging.getLogger)('aurelia-html-only-element').warn('Expected \'use-shadow-dom\' value to be "close", "open" or "", received ' + useShadowDOMmode);
+      break;
+  }
+
   return DynamicElement;
 }