Files
angular-docs-cn/packages/core/test/util
Misko Hevery 6bf99e0eda fix(core): fix possible XSS attack in development through SSR (#40525)
This is a follow up fix for
https://github.com/angular/angular/pull/40136/commits/894286dd0c92b5af223364237e63798e18b14f58.

It turns out that comments can be closed in several ways:
- `<!-->`
- `<!-- -->`
- `<!-- --!>`

All of the above are valid ways to close comment per:
https://html.spec.whatwg.org/multipage/syntax.html#comments

The new fix surrounds `<` and `>` with zero width space so that it
renders in the same way, but it prevents the comment to be closed eagerly.

PR Close #40525
2021-01-26 09:32:27 -08:00
..