diff --git a/gulpfile.js b/gulpfile.js index b152763449..6125fe8faa 100644 --- a/gulpfile.js +++ b/gulpfile.js @@ -671,9 +671,9 @@ gulp.task('lint', function() { '!./public/docs/_examples/_protractor/**/*', '!./public/docs/_examples/**/typings/**/*', '!./public/docs/_examples/**/typings-ng1/**/*', + '!./public/docs/_examples/**/build/**/*', // temporary until codelyzer is fixed mgechev/codelyzer#60 '!./public/docs/_examples/animations/ts/app/hero.service.ts' - ]) .pipe(tslint({ rulesDirectory: ['node_modules/codelyzer'], diff --git a/harp.json b/harp.json index 870a2a2c00..5811da34b1 100644 --- a/harp.json +++ b/harp.json @@ -477,6 +477,13 @@ "twitter": "rexebin", "bio": "Rex is a full-stack developer. He maintains the Angular.cn website with his old pal Ralph Wang and he plays a key role in bridging between the Chinese Angular community and the world-wide community. He loves playing with flashy new technologies and enjoys the challenge of mastering new skills. His biggest challenge to date is figuring out how to sooth a crying 4-month-old baby.", "type": "Community" + }, + "ralph": { + "name": "Ralph Wang", + "picture": "/resources/images/bios/ralph.jpg", + "twitter": "ralph_wang_gde", + "bio": "Ralph(Zhicheng Wang) is a senior consultant at ThoughWorks and also a GDE. He is a technology enthusiast and he is a passionate advocate of “Simplicity, Professionalism and Sharing”. In his eighteen years of R&D career, he worked as tester, R&D engineer, project manager, product manager and CTO. He is looking forward to the birth of his baby.", + "type": "Community" } } } diff --git a/public/_data.json b/public/_data.json index 0a3207c9a7..313fac9bed 100644 --- a/public/_data.json +++ b/public/_data.json @@ -32,17 +32,5 @@ }, "presskit": { "title": "宣传资料" - }, - "books": { - "title": "书籍" - }, - "training": { - "title": "培训" - }, - "communities": { - "title": "社区" - }, - "tooling": { - "title": "工具与库" } } diff --git a/public/docs/_examples/package.json b/public/docs/_examples/package.json index c7aa9ffbb9..f6d67f4ce9 100644 --- a/public/docs/_examples/package.json +++ b/public/docs/_examples/package.json @@ -25,17 +25,17 @@ "author": "", "license": "ISC", "dependencies": { - "@angular/common": "2.0.0-rc.3", - "@angular/compiler": "2.0.0-rc.3", - "@angular/core": "2.0.0-rc.3", - "@angular/forms": "0.1.1", - "@angular/http": "2.0.0-rc.3", - "@angular/platform-browser": "2.0.0-rc.3", - "@angular/platform-browser-dynamic": "2.0.0-rc.3", - "@angular/router": "3.0.0-alpha.8", + "@angular/common": "2.0.0-rc.4", + "@angular/compiler": "2.0.0-rc.4", + "@angular/core": "2.0.0-rc.4", + "@angular/forms": "0.2.0", + "@angular/http": "2.0.0-rc.4", + "@angular/platform-browser": "2.0.0-rc.4", + "@angular/platform-browser-dynamic": "2.0.0-rc.4", + "@angular/router": "3.0.0-beta.1", "@angular/router-deprecated": "2.0.0-rc.2", - "@angular/upgrade": "2.0.0-rc.3", - "angular2-in-memory-web-api": "0.0.12", + "@angular/upgrade": "2.0.0-rc.4", + "angular2-in-memory-web-api": "0.0.14", "bootstrap": "^3.3.6", "core-js": "^2.4.0", "reflect-metadata": "^0.1.3", diff --git a/public/docs/_examples/quickstart/js/package.1.json b/public/docs/_examples/quickstart/js/package.1.json index 7f58576e80..358034f15e 100644 --- a/public/docs/_examples/quickstart/js/package.1.json +++ b/public/docs/_examples/quickstart/js/package.1.json @@ -7,23 +7,23 @@ }, "license": "ISC", "dependencies": { - "@angular/common": "2.0.0-rc.3", - "@angular/compiler": "2.0.0-rc.3", - "@angular/core": "2.0.0-rc.3", - "@angular/forms": "0.1.1", - "@angular/http": "2.0.0-rc.3", - "@angular/platform-browser": "2.0.0-rc.3", - "@angular/platform-browser-dynamic": "2.0.0-rc.3", - "@angular/router": "3.0.0-alpha.8", - "@angular/router-deprecated": "2.0.0-rc.2", - "@angular/upgrade": "2.0.0-rc.3", + "@angular/common": "2.0.0-rc.4", + "@angular/compiler": "2.0.0-rc.4", + "@angular/core": "2.0.0-rc.4", + "@angular/forms": "0.2.0", + "@angular/http": "2.0.0-rc.4", + "@angular/platform-browser": "2.0.0-rc.4", + "@angular/platform-browser-dynamic": "2.0.0-rc.4", + "@angular/router": "3.0.0-beta.1", + "@angular/router-deprecated": "2.0.0-rc.2", + "@angular/upgrade": "2.0.0-rc.4", "core-js": "^2.4.0", "reflect-metadata": "0.1.3", "rxjs": "5.0.0-beta.6", "zone.js": "0.6.12", - "angular2-in-memory-web-api": "0.0.12", + "angular2-in-memory-web-api": "0.0.14", "bootstrap": "^3.3.6" }, "devDependencies": { diff --git a/public/docs/_examples/quickstart/ts/package.1.json b/public/docs/_examples/quickstart/ts/package.1.json index e57d118d8f..ef5d180619 100644 --- a/public/docs/_examples/quickstart/ts/package.1.json +++ b/public/docs/_examples/quickstart/ts/package.1.json @@ -11,16 +11,16 @@ }, "license": "ISC", "dependencies": { - "@angular/common": "2.0.0-rc.3", - "@angular/compiler": "2.0.0-rc.3", - "@angular/core": "2.0.0-rc.3", - "@angular/forms": "0.1.1", - "@angular/http": "2.0.0-rc.3", - "@angular/platform-browser": "2.0.0-rc.3", - "@angular/platform-browser-dynamic": "2.0.0-rc.3", - "@angular/router": "3.0.0-alpha.8", - "@angular/router-deprecated": "2.0.0-rc.2", - "@angular/upgrade": "2.0.0-rc.3", + "@angular/common": "2.0.0-rc.4", + "@angular/compiler": "2.0.0-rc.4", + "@angular/core": "2.0.0-rc.4", + "@angular/forms": "0.2.0", + "@angular/http": "2.0.0-rc.4", + "@angular/platform-browser": "2.0.0-rc.4", + "@angular/platform-browser-dynamic": "2.0.0-rc.4", + "@angular/router": "3.0.0-beta.1", + "@angular/router-deprecated": "2.0.0-rc.2", + "@angular/upgrade": "2.0.0-rc.4", "systemjs": "0.19.27", "core-js": "^2.4.0", @@ -28,7 +28,7 @@ "rxjs": "5.0.0-beta.6", "zone.js": "^0.6.12", - "angular2-in-memory-web-api": "0.0.12", + "angular2-in-memory-web-api": "0.0.14", "bootstrap": "^3.3.6" }, "devDependencies": { diff --git a/public/docs/_examples/security/e2e-spec.ts b/public/docs/_examples/security/e2e-spec.ts index 410f1428e1..d1a373a781 100644 --- a/public/docs/_examples/security/e2e-spec.ts +++ b/public/docs/_examples/security/e2e-spec.ts @@ -1,7 +1,8 @@ /// 'use strict'; + describe('Security E2E Tests', () => { - beforeAll(function() { browser.get(''); }); + beforeAll(() => browser.get('')); it('sanitizes innerHTML', () => { let interpolated = element(By.className('e2e-inner-html-interpolated')); @@ -13,13 +14,23 @@ describe('Security E2E Tests', () => { expect(bold.getText()).toContain('Syntax'); }); + it('escapes untrusted URLs', () => { + let untrustedUrl = element(By.className('e2e-dangerous-url')); + expect(untrustedUrl.getAttribute('href')).toMatch(/^unsafe:javascript/); + }); + it('binds trusted URLs', () => { - let dangerousUrl = element(By.className('e2e-dangerous-url')); - expect(dangerousUrl.getAttribute('href')).toMatch(/^javascript:alert/); + let trustedUrl = element(By.className('e2e-trusted-url')); + expect(trustedUrl.getAttribute('href')).toMatch(/^javascript:alert/); + }); + + it('escapes untrusted resource URLs', () => { + let iframe = element(By.className('e2e-iframe-untrusted-src')); + expect(iframe.getAttribute('src')).toBe(''); }); it('binds trusted resource URLs', () => { - let iframe = element(By.className('e2e-iframe')); + let iframe = element(By.className('e2e-iframe-trusted-src')); expect(iframe.getAttribute('src')).toMatch(/^https:\/\/www.youtube.com\//); }); }); diff --git a/public/docs/_examples/security/ts/app/app.component.ts b/public/docs/_examples/security/ts/app/app.component.ts index 153e6b9e49..a2fc7e7320 100644 --- a/public/docs/_examples/security/ts/app/app.component.ts +++ b/public/docs/_examples/security/ts/app/app.component.ts @@ -5,7 +5,7 @@ import { BypassSecurityComponent } from './bypass-security.component'; import { InnerHtmlBindingComponent } from './inner-html-binding.component'; @Component({ - selector: 'app-root', + selector: 'my-app', template: `

Security

@@ -14,7 +14,7 @@ import { InnerHtmlBindingComponent } from './inner-html-binding.component'; directives: [ BypassSecurityComponent, InnerHtmlBindingComponent, - ], + ] }) export class AppComponent { } diff --git a/public/docs/_examples/security/ts/app/bypass-security.component.html b/public/docs/_examples/security/ts/app/bypass-security.component.html index 75b7734dd4..1b0a9d0c0e 100644 --- a/public/docs/_examples/security/ts/app/bypass-security.component.html +++ b/public/docs/_examples/security/ts/app/bypass-security.component.html @@ -2,14 +2,19 @@

Bypass Security Component

-

A dangerous URL:

-

Click me.

+

A untrusted URL:

+

Click me

+

A trusted URL:

+

Click me

Resource URL:

- +

Trusted:

+ +

Untrusted:

+ diff --git a/public/docs/_examples/security/ts/app/bypass-security.component.ts b/public/docs/_examples/security/ts/app/bypass-security.component.ts index 6a5f350d28..a18d4251a5 100644 --- a/public/docs/_examples/security/ts/app/bypass-security.component.ts +++ b/public/docs/_examples/security/ts/app/bypass-security.component.ts @@ -8,14 +8,18 @@ import { DomSanitizationService, SafeResourceUrl, SafeUrl } from '@angular/platf templateUrl: 'app/bypass-security.component.html', }) export class BypassSecurityComponent { - dangerousUrl: SafeUrl; + dangerousUrl: string; + trustedUrl: SafeUrl; + dangerousVideoUrl: string; videoUrl: SafeResourceUrl; // #docregion trust-url constructor(private sanitizer: DomSanitizationService) { - // javascript: URLs are dangerous if attacker controlled. Angular sanitizes them in data - // binding, but we can explicitly tell Angular to trust this value: - this.dangerousUrl = sanitizer.bypassSecurityTrustUrl('javascript:alert("Hi there")'); + // javascript: URLs are dangerous if attacker controlled. + // Angular sanitizes them in data binding, but we can + // explicitly tell Angular to trust this value: + this.dangerousUrl = 'javascript:alert("Hi there")'; + this.trustedUrl = sanitizer.bypassSecurityTrustUrl(this.dangerousUrl); // #enddocregion trust-url this.updateVideoUrl('PUBnlbjZFAI'); } @@ -23,11 +27,12 @@ export class BypassSecurityComponent { // #docregion trust-video-url updateVideoUrl(id: string) { // Appending an ID to a YouTube URL is safe. - // Always make sure to construct SafeValue objects as close as possible to the input data, so + // Always make sure to construct SafeValue objects as + // close as possible to the input data, so // that it's easier to check if the value is safe. + this.dangerousVideoUrl = 'https://www.youtube.com/embed/' + id; this.videoUrl = - this.sanitizer.bypassSecurityTrustResourceUrl('https://www.youtube.com/embed/' + id); + this.sanitizer.bypassSecurityTrustResourceUrl(this.dangerousVideoUrl); } // #enddocregion trust-video-url } -// #enddocregion diff --git a/public/docs/_examples/security/ts/app/inner-html-binding.component.ts b/public/docs/_examples/security/ts/app/inner-html-binding.component.ts index 95a9f55979..0419e5b324 100644 --- a/public/docs/_examples/security/ts/app/inner-html-binding.component.ts +++ b/public/docs/_examples/security/ts/app/inner-html-binding.component.ts @@ -11,4 +11,3 @@ export class InnerHtmlBindingComponent { // E.g. a user/attacker controlled value from a URL. htmlSnippet = 'Template Syntax'; } -// #enddocregion inner-html-controller diff --git a/public/docs/_examples/security/ts/index.html b/public/docs/_examples/security/ts/index.html index b665a8bc6f..16eeeb2b2a 100644 --- a/public/docs/_examples/security/ts/index.html +++ b/public/docs/_examples/security/ts/index.html @@ -1,5 +1,5 @@ - + Angular Content Security @@ -21,6 +21,6 @@ - Loading... + Loading... diff --git a/public/docs/_examples/systemjs.config.plunker.js b/public/docs/_examples/systemjs.config.plunker.js index a9ec367c33..fbf84a69ba 100644 --- a/public/docs/_examples/systemjs.config.plunker.js +++ b/public/docs/_examples/systemjs.config.plunker.js @@ -5,9 +5,9 @@ */ (function(global) { - var ngVer = '@2.0.0-rc.3'; // lock in the angular package version; do not let it float to current! - var routerVer = '@3.0.0-alpha.7'; // lock router version - var formsVer = '@0.1.1'; // lock forms version + var ngVer = '@2.0.0-rc.4'; // lock in the angular package version; do not let it float to current! + var routerVer = '@3.0.0-beta.1'; // lock router version + var formsVer = '@0.2.0'; // lock forms version var routerDeprecatedVer = '@2.0.0-rc.2'; // temporarily until we update all the guides //map tells the System loader where to look for things diff --git a/public/docs/_examples/template-syntax/ts/app/app.component.html b/public/docs/_examples/template-syntax/ts/app/app.component.html index fbe3527362..ebd9981e1a 100644 --- a/public/docs/_examples/template-syntax/ts/app/app.component.html +++ b/public/docs/_examples/template-syntax/ts/app/app.component.html @@ -589,18 +589,9 @@ bindon-ngModel
({{hero.id}}) {{hero.fullName}}
-

with *ngForTrackBy

-
- -
({{hero.id}}) {{hero.fullName}}
- -
-

with generic trackById function

- -
({{hero.id}}) {{hero.fullName}}
- +
({{hero.id}}) {{hero.fullName}}
top diff --git a/public/docs/_examples/toh-5/ts/app/app.routes.2.ts b/public/docs/_examples/toh-5/ts/app/app.routes.2.ts index 45ddeb9230..47311fcd8d 100644 --- a/public/docs/_examples/toh-5/ts/app/app.routes.2.ts +++ b/public/docs/_examples/toh-5/ts/app/app.routes.2.ts @@ -4,7 +4,7 @@ import { HeroesComponent } from './heroes.component'; const routes: RouterConfig = [ { - path: '/heroes', + path: 'heroes', component: HeroesComponent } ]; diff --git a/public/docs/_examples/upgrade-phonecat-3-final/ts/app/phone-list/phone-list.component.spec.ts b/public/docs/_examples/upgrade-phonecat-3-final/ts/app/phone-list/phone-list.component.spec.ts index 3e0f5f1943..3d6cd93b15 100644 --- a/public/docs/_examples/upgrade-phonecat-3-final/ts/app/phone-list/phone-list.component.spec.ts +++ b/public/docs/_examples/upgrade-phonecat-3-final/ts/app/phone-list/phone-list.component.spec.ts @@ -1,25 +1,28 @@ +/* tslint:disable */ // #docregion routestuff -import { ApplicationRef } from '@angular/core'; -import { LocationStrategy } from '@angular/common'; +import { Directive } from '@angular/core'; import { HTTP_PROVIDERS } from '@angular/http'; import { - ROUTER_PROVIDERS, + Router, + RouterLink, + RootRouter, + RouteRegistry, ROUTER_PRIMARY_COMPONENT } from '@angular/router-deprecated'; import { Observable } from 'rxjs/Rx'; import { describe, - beforeEachProviders, + addProviders, inject, it, expect, - MockApplicationRef + // MockApplicationRef } from '@angular/core/testing'; -import { MockLocationStrategy } from '@angular/common/testing'; +import { SpyLocation } from '@angular/common/testing'; import { TestComponentBuilder, ComponentFixture -} from '@angular/compiler/testing'; +} from '@angular/core/testing'; import { AppComponent } from '../app.component'; import { PhoneListComponent } from './phone-list.component'; @@ -27,6 +30,11 @@ import { Phone, PhoneData } from '../core/phone/phone.service'; // #enddocregion routestuff +@Directive({ + selector: '[routerLink]', + inputs: ['routeParams: routerLink', 'target: target'] +}) +class RouterLinkMock {} class MockPhone extends Phone { query(): Observable { @@ -41,19 +49,22 @@ describe('PhoneList', () => { // #docregion routestuff - beforeEachProviders(() => [ - { provide: Phone, useClass: MockPhone}, - HTTP_PROVIDERS, - ROUTER_PROVIDERS, - { provide: ApplicationRef, useClass: MockApplicationRef }, + addProviders([ + RouteRegistry, + { provide: Router, useClass: RootRouter }, { provide: ROUTER_PRIMARY_COMPONENT, useValue: AppComponent }, - { provide: LocationStrategy, useClass: MockLocationStrategy}, + { provide: Location, useClass: SpyLocation}, + { provide: Phone, useClass: MockPhone}, + HTTP_PROVIDERS ]); // #enddocregion routestuff it('should create "phones" model with 2 phones fetched from xhr', inject([TestComponentBuilder], (tcb: TestComponentBuilder) => { - return tcb.createAsync(PhoneListComponent) + return tcb + .overrideDirective(AppComponent, RouterLink, RouterLinkMock) + .overrideDirective(PhoneListComponent, RouterLink, RouterLinkMock) + .createAsync(PhoneListComponent) .then((fixture: ComponentFixture) => { fixture.detectChanges(); let compiled = fixture.debugElement.nativeElement; @@ -69,7 +80,10 @@ describe('PhoneList', () => { it('should set the default value of orderProp model', inject([TestComponentBuilder], (tcb: TestComponentBuilder) => { - return tcb.createAsync(PhoneListComponent) + return tcb + .overrideDirective(AppComponent, RouterLink, RouterLinkMock) + .overrideDirective(PhoneListComponent, RouterLink, RouterLinkMock) + .createAsync(PhoneListComponent) .then((fixture: ComponentFixture) => { fixture.detectChanges(); let compiled = fixture.debugElement.nativeElement; diff --git a/public/docs/_examples/webpack/ts/package.webpack.json b/public/docs/_examples/webpack/ts/package.webpack.json index cc5948be7f..8d7fa67496 100644 --- a/public/docs/_examples/webpack/ts/package.webpack.json +++ b/public/docs/_examples/webpack/ts/package.webpack.json @@ -10,14 +10,14 @@ }, "license": "MIT", "dependencies": { - "@angular/common": "2.0.0-rc.3", - "@angular/compiler": "2.0.0-rc.3", - "@angular/core": "2.0.0-rc.3", - "@angular/forms": "0.1.1", - "@angular/http": "2.0.0-rc.3", - "@angular/platform-browser": "2.0.0-rc.3", - "@angular/platform-browser-dynamic": "2.0.0-rc.3", - "@angular/router": "3.0.0-alpha.8", + "@angular/common": "2.0.0-rc.4", + "@angular/compiler": "2.0.0-rc.4", + "@angular/core": "2.0.0-rc.4", + "@angular/forms": "0.2.0", + "@angular/http": "2.0.0-rc.4", + "@angular/platform-browser": "2.0.0-rc.4", + "@angular/platform-browser-dynamic": "2.0.0-rc.4", + "@angular/router": "3.0.0-beta.1", "core-js": "^2.4.0", "reflect-metadata": "0.1.2", "rxjs": "5.0.0-beta.6", diff --git a/public/docs/js/latest/_data.json b/public/docs/js/latest/_data.json index 5227a9dd16..7d5ed7b13a 100644 --- a/public/docs/js/latest/_data.json +++ b/public/docs/js/latest/_data.json @@ -3,7 +3,7 @@ "icon": "home", "title": "Angular Docs", "menuTitle": "Docs Home", - "banner": "Welcome to Angular in JavaScript! The current Angular 2 release is rc.3. Please consult the Change Log about recent enhancements, fixes, and breaking changes." + "banner": "Welcome to Angular in JavaScript! The current Angular 2 release is rc.4. Please consult the Change Log about recent enhancements, fixes, and breaking changes." }, "quickstart": { diff --git a/public/docs/ts/latest/_data.json b/public/docs/ts/latest/_data.json index 891bbfaad6..700393423a 100644 --- a/public/docs/ts/latest/_data.json +++ b/public/docs/ts/latest/_data.json @@ -3,7 +3,7 @@ "icon": "home", "title": "Angular文档", "menuTitle": "文档首页", - "banner": "欢迎来到 Angular in TypeScript! 当前的Angular版本是 rc.3。请参考变更记录、最新功能、BUG修复和重大的破坏性更改。" + "banner": "欢迎来到 Angular in TypeScript! 当前的Angular版本是 rc.4。请参考变更记录、最新功能、BUG修复和重大的破坏性更改。" }, "cli-quickstart": { diff --git a/public/docs/ts/latest/guide/router.jade b/public/docs/ts/latest/guide/router.jade index 0a9fb705f2..dc1682c9c7 100644 --- a/public/docs/ts/latest/guide/router.jade +++ b/public/docs/ts/latest/guide/router.jade @@ -3,7 +3,7 @@ include ../_util-fns .alert.is-important :marked - The Component Router is in alpha release. This is the recommended Angular 2 router and supersedes + The Component Router is in beta release. This is the recommended Angular 2 router and supersedes the earlier *deprecated beta* and *v2* routers. 组件路由器已经进入了Alpha阶段，推荐在Angular 2中使用此路由器，以取代早前*废弃的beta版*及*第二版*路由器。 @@ -1612,7 +1612,7 @@ h3#nav-to-list 导航回列表组件 除非我们能学到点新东西，否则这种练习就没啥亮点。 不过，我们已经有了一些新主意和新技巧： - * We'd like our route URLs to branch in to child route trees that reflect the component treese in our feature areas. + * We'd like our route URLs to branch in to child route trees that reflect the component trees in our feature areas. * 我们希望把这些路由地址组织成一棵子路由树，它应该能反映本特性区中组件树的结构。 @@ -1909,8 +1909,8 @@ code-example(format=""). :marked Since we only want to redirect when our path specifically matches `''`, we've added an extra configuration - to our route using `terminal: true`. Mainly for redirects, the `terminal` property gives us more control over - when the router should continue matching our URL against our defined routes. + to our route using `terminal: true`. Mainly for redirects, the `terminal` property tells the router + whether or not it should continue matching our URL against the rest of our defined routes. 由于我们希望只有在路径明确的匹配到`''`时才重定向，所以我们往路由中添加了一个额外的配置项：`terminal: true`。 主要是为了重定向，`terminal`属性是用来控制路由器是否应该继续匹配URL和我们定义的路由。（译者注：`terminal`设置为`true`时，该路由的优先级别就低于其他路由，只有在所有其他路由都不匹配的时候才最后匹配这个路由。主要是为了标示专用于重定向的路由而设计的。） diff --git a/public/docs/ts/latest/guide/security.jade b/public/docs/ts/latest/guide/security.jade index 98958083e0..3eb7506f4f 100644 --- a/public/docs/ts/latest/guide/security.jade +++ b/public/docs/ts/latest/guide/security.jade @@ -1,7 +1,7 @@ block includes include ../_util-fns :marked - Web application security has many aspects. This documentation describes Angular's built in + Web application security has many aspects. This chapter describes Angular's built in protections against common web application vulnerabilities and attacks, such as Cross Site Scripting Attacks. It does not cover application level security, such as authentication (_Who is this user?_) or authorization (_What can this user do?_). @@ -97,7 +97,7 @@ h2#xss 防范跨站脚本(XSS)攻击 :marked [Cross-Site Scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting) enables attackers - to inject malicious code into web pages. Such code can then for example steal user's data (in + to inject malicious code into web pages. Such code can then, for example, steal user's data (in particular their login data), or perform actions impersonating the user. This is one of the most common attacks on the web. @@ -151,7 +151,7 @@ h2#xss 防范跨站脚本(XSS)攻击 Angular定义了四个安全环境：HTML，样式，URL，和资源URL。 - * HTML is used when interpreting a value as HTML, e.g. when binding to `innerHtml` + * HTML is used when interpreting a value as HTML, e.g., when binding to `innerHtml` * HTML：值需要被解释为HTML时使用，比如当绑定到`innerHTML`时。 @@ -163,7 +163,7 @@ h2#xss 防范跨站脚本(XSS)攻击 * URL：值需要被用作URL属性时使用，比如``。 - * Resource URLs are URLs that will be loaded and executed as code, e.g. in `