Skip to content
This repository was archived by the owner on May 20, 2023. It is now read-only.

Commit a548321

Browse files
committed
Update links and and documentation based on feedback from open source repo
- Harden URLs by linking to the official docs rather than lines of code. - Fix link to Angular (not AngularDart) GitHub repo. - Add the parenthesis to method names to match other documentation. PiperOrigin-RevId: 225335014
1 parent 2b3694b commit a548321

File tree

1 file changed

+9
-9
lines changed

1 file changed

+9
-9
lines changed

angular_components/lib/simple_html/README.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ HTML in the following use cases:
1313
Mixing these features with text that cannot appear verbatim in the template (due
1414
to, for example, use of the `Intl` library for localization) is otherwise
1515
difficult. This component is the recommended alternative to calling methods like
16-
[`bypassSecurityTrustHtml`](https://github.com/dart-lang/angular/blob/master/angular/lib/src/security/dom_sanitization_service.dart#L53)
16+
[`bypassSecurityTrustHtml()`](https://pub.dartlang.org/documentation/angular/latest/angular.security/DomSanitizationService/bypassSecurityTrustHtml.html)
1717
when inserting HTML into the DOM.
1818

1919

@@ -44,7 +44,7 @@ The alternatives include:
4444
and the permitted URLs by the
4545
[_SameOriginUriPolicy](https://raw.githubusercontent.com/dart-lang/sdk/master/sdk/lib/html/dart2js/html_dart2js.dart).
4646
* Using the `[safeInnerHtml]` directive, or the `[innerHtml]` directive with a
47-
`SafeHtml` argument generated by `bypassSecurityTrustHtml`.
47+
`SafeHtml` argument generated by `bypassSecurityTrustHtml()`.
4848
* This is generally not secure, since absolutely all tags are allowed and
4949
there is no further line of defense between you and
5050
[XSS](https://en.wikipedia.org/wiki/Cross-site_scripting). This should
@@ -108,9 +108,9 @@ You have a few options:
108108
If `seeHelpCenterMessage` is a plain string, it will be strictly sanitized
109109
and disallowed elements silently removed. To work around this,
110110
`seeHelpCenterMessage` may instead return a
111-
[`SafeHtml`](https://github.com/dart-lang/angular/blob/master/angular/lib/src/security/dom_sanitization_service.dart#L5)
111+
[`SafeHtml`](https://pub.dartlang.org/documentation/angular/latest/angular.security/SafeHtml-class.html)
112112
object. This object can be constructed by calling
113-
[`bypassSecurityTrustHtml`](https://github.com/dart-lang/angular/blob/master/angular/lib/src/security/dom_sanitization_service.dart#L53)
113+
[`bypassSecurityTrustHtml()`](https://pub.dartlang.org/documentation/angular/latest/angular.security/DomSanitizationService/bypassSecurityTrustHtml.html)
114114
on the string. However, this is very dangerous because it disables _all_
115115
sanitization and allows all tags (even `<script>`). If the string
116116
accidentally contains user-controlled data, or the translator made a mistake
@@ -251,17 +251,17 @@ The following is not yet supported:
251251
252252
## Migration
253253
254-
Migration from an existing `bypassSecurityTrustHtml` solution is generally
254+
Migration from an existing `bypassSecurityTrustHtml()` solution is generally
255255
straightforward. Basic steps:
256256
257257
1. Import the Dart library
258258
`package:angular_components/simple_html/simple_html.dart` in your component
259259
file.
260260
1. Add the `SimpleHtmlComponent` to your
261-
[@Component](https://github.com/angular/angular/blob/master/packages/core/src/metadata/directives.ts#L101)'s
261+
[@Component](https://pub.dartlang.org/documentation/angular/latest/angular/Component-class.html)'s
262262
directive list.
263-
1. For each message that previously used `bypassSecurityTrustHtml`, remove that
264-
call and use the string directly.
263+
1. For each message that previously used `bypassSecurityTrustHtml()`, remove
264+
that call and use the string directly.
265265
1. In your template file, bind the message with either:
266266
* `<simple-html [contents]="msg"></simple-html>` rather than `<span
267267
[innerHtml]="msg"></span>` (if only inline elements are required).
@@ -280,7 +280,7 @@ so, if you need other display types, you will need to apply a custom CSS class
280280
or wrap it inside another element. Likewise `<simple-html-block>` is a
281281
block-level element and therefore should not be placed inside inline elements.
282282
283-
### Testing {#testing}
283+
### Testing
284284
285285
The easiest way to debug quickly is to test that the text appears correctly in a
286286
local build of your application. Due to SimpleHtml's atomic updates, you will

0 commit comments

Comments
 (0)