From 8b0cccca457801aa57427effc28c3dfe6b037c29 Mon Sep 17 00:00:00 2001 From: arturovt Date: Thu, 3 Dec 2020 23:04:03 +0200 Subject: [PATCH] perf(core): use `ngDevMode` to tree-shake warnings (#39959) This commit adds `ngDevMode` guard to show sanitization warnings only in dev mode (similar to how things work in other parts of Ivy runtime code). The `ngDevMode` flag helps to tree-shake these warnings from production builds (in dev mode everything will work as it works right now) to decrease production bundle size. PR Close #39959 --- goldens/size-tracking/integration-payloads.json | 2 +- packages/core/src/sanitization/html_sanitizer.ts | 3 +-- packages/core/src/sanitization/url_sanitizer.ts | 3 +-- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/goldens/size-tracking/integration-payloads.json b/goldens/size-tracking/integration-payloads.json index 38f8eedc64..a06f63162e 100644 --- a/goldens/size-tracking/integration-payloads.json +++ b/goldens/size-tracking/integration-payloads.json @@ -39,7 +39,7 @@ "master": { "uncompressed": { "runtime-es2015": 2285, - "main-es2015": 242455, + "main-es2015": 241837, "polyfills-es2015": 36709, "5-es2015": 745 } diff --git a/packages/core/src/sanitization/html_sanitizer.ts b/packages/core/src/sanitization/html_sanitizer.ts index d55dd9fe24..b5121d452a 100644 --- a/packages/core/src/sanitization/html_sanitizer.ts +++ b/packages/core/src/sanitization/html_sanitizer.ts @@ -6,7 +6,6 @@ * found in the LICENSE file at https://angular.io/license */ -import {isDevMode} from '../util/is_dev_mode'; import {TrustedHTML} from '../util/security/trusted_type_defs'; import {trustedHTMLFromString} from '../util/security/trusted_types'; import {getInertBodyHelper, InertBodyHelper} from './inert_body'; @@ -271,7 +270,7 @@ export function _sanitizeHtml(defaultDoc: any, unsafeHtmlInput: string): Trusted const sanitizer = new SanitizingHtmlSerializer(); const safeHtml = sanitizer.sanitizeChildren( getTemplateContent(inertBodyElement!) as Element || inertBodyElement); - if (isDevMode() && sanitizer.sanitizedSomething) { + if ((typeof ngDevMode === 'undefined' || ngDevMode) && sanitizer.sanitizedSomething) { console.warn( 'WARNING: sanitizing HTML stripped some content, see https://g.co/ng/security#xss'); } diff --git a/packages/core/src/sanitization/url_sanitizer.ts b/packages/core/src/sanitization/url_sanitizer.ts index 67e5fb8563..526927e4f2 100644 --- a/packages/core/src/sanitization/url_sanitizer.ts +++ b/packages/core/src/sanitization/url_sanitizer.ts @@ -6,7 +6,6 @@ * found in the LICENSE file at https://angular.io/license */ -import {isDevMode} from '../util/is_dev_mode'; /** * A pattern that recognizes a commonly useful subset of URLs that are safe. @@ -47,7 +46,7 @@ export function _sanitizeUrl(url: string): string { url = String(url); if (url.match(SAFE_URL_PATTERN) || url.match(DATA_URL_PATTERN)) return url; - if (isDevMode()) { + if (typeof ngDevMode === 'undefined' || ngDevMode) { console.warn(`WARNING: sanitizing unsafe URL value ${url} (see https://g.co/ng/security#xss)`); }