GreenPolyProducts/polymer
5
0
Fork 0
mirror of https://github.com/Polymer/polymer.git synced 2026-08-19 01:14:44 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5295 from Polymer/strict-template-policy-2.x

Browse Source 
[2.x] Introduce strictTemplatePolicy
This commit is contained in:
Kevin Schaaf
2018-11-05 11:31:39 -08:00
committed by GitHub
parent 79de83cee0 08b267f338
commit 8882c3db24
9 changed files with 574 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/elements/dom-bind.html
+3
View File
@@ -57,6 +57,9 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
constructor() {
super();
if (Polymer.strictTemplatePolicy) {
throw new Error(`strictTemplatePolicy: dom-bind not allowed`);
}
this.root = null;
this.$ = null;
this.__children = null;
lib/elements/dom-if.html
+6 -2
View File
@@ -255,8 +255,12 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
if (c$ && c$.length) {
// use first child parent, for case when dom-if may have been detached
let parent = c$[0].parentNode;
for (let i=0, n; (i<c$.length) && (n=c$[i]); i++) {
parent.removeChild(n);
// Instance children may be disconnected from parents when dom-if
// detaches if a tree was innerHTML'ed
if (parent) {
for (let i=0, n; (i<c$.length) && (n=c$[i]); i++) {
parent.removeChild(n);
}
}
}
this.__instance = null;
lib/elements/dom-module.html
+13 -5
View File
@@ -15,6 +15,12 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
let modules = {};
let lcModules = {};
function setModule(id, module) {
// store id separate from lowercased id so that
// in all cases mixedCase id will stored distinctly
// and lowercase version is a fallback
modules[id] = lcModules[id.toLowerCase()] = module;
}
function findModule(id) {
return modules[id] || lcModules[id.toLowerCase()];
}
@@ -124,12 +130,14 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
register(id) {
id = id || this.id;
if (id) {
// Under strictTemplatePolicy, reject and null out any re-registered
// dom-module since it is ambiguous whether first-in or last-in is trusted
if (Polymer.strictTemplatePolicy && findModule(id) !== undefined) {
setModule(id, null);
throw new Error(`strictTemplatePolicy: dom-module ${id} re-registered`);
}
this.id = id;
// store id separate from lowercased id so that
// in all cases mixedCase id will stored distinctly
// and lowercase version is a fallback
modules[id] = this;
lcModules[id.toLowerCase()] = this;
setModule(id, this);
styleOutsideTemplateCheck(this);
}
}
lib/legacy/class.html
+9 -16
View File
@@ -153,22 +153,6 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
return info.observers;
}
/**
* @return {HTMLTemplateElement} template for this class
*/
static get template() {
// get template first from any imperative set in `info._template`
return info._template ||
// next look in dom-module associated with this element's is.
Polymer.DomModule && Polymer.DomModule.import(this.is, 'template') ||
// next look for superclass template (note: use superclass symbol
// to ensure correct `this.is`)
Base.template ||
// finally fall back to `_template` in element's prototype.
this.prototype._template ||
null;
}
/**
* @return {void}
*/
@@ -371,6 +355,15 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
const klass = GenerateClassFromInfo(info, baseWithMixin);
// decorate klass with registration info
klass.is = info.is;
// To match 1.x behavior, `_template` supplied on a behavior should take
// precedence over dom-module lookup for `is`; this also prevents
// dom-module injection under strictTemplatePolicy for an element that
// would normally get its template from a behavior.
// TODO(sorvell): Remove once "flattened behaviors" lands, since both
// `_template` and `is` will be on the same class after that change
if (klass.prototype._template !== undefined) {
klass.prototype._template = klass.prototype._template;
}
return klass;
};
lib/mixins/element-mixin.html
+58 -11
View File
@@ -130,7 +130,7 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
}
/**
* Returns a memoized version of the the `observers` array.
* Returns a memoized version of the `observers` array.
* @param {PolymerElementConstructor} constructor Element class
* @return {Array} Array containing own observers for the given class
* @protected
@@ -154,7 +154,7 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
* alter these settings. However, additional `observers` may be added
* by subclasses.
*
* The info object should may contain property metadata as follows:
* The info object should contain property metadata as follows:
*
* * `type`: {function} type to which an attribute matching the property
* is deserialized. Note the property is camel-cased from a dash-cased
@@ -166,7 +166,7 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
* property 'foo',
*
* * `computed`: {string} creates a computed property. A computed property
* also automatically is set to `readOnly: true`. The value is calculated
* is also automatically set to `readOnly: true`. The value is calculated
* by running a method and arguments parsed from the given string. For
* example 'compute(foo)' will compute a given property when the
* 'foo' property changes by executing the 'compute' method. This method
@@ -277,6 +277,27 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
}
/**
* Look up template from dom-module for element
*
* @param {!string} is Element name to look up
* @return {!HTMLTemplateElement} Template found in dom module, or
* undefined if not found
* @protected
*/
function getTemplateFromDomModule(is) {
let template = null;
if (is && Polymer.DomModule) {
template = Polymer.DomModule.import(is, 'template');
// Under strictTemplatePolicy, require any element with an `is`
// specified to have a dom-module
if (Polymer.strictTemplatePolicy && !template) {
throw new Error(`strictTemplatePolicy: expecting dom-module or null template for ${is}`);
}
}
return template;
}
/**
* @polymer
* @mixinClass
* @unrestricted
@@ -374,7 +395,7 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
* class MySubClass extends MySuperClass {
* static get template() {
* if (!memoizedTemplate) {
* memoizedTemplate = super.template.cloneNode(true);
* memoizedTemplate = MySuperClass.template.cloneNode(true);
* let subContent = document.createElement('div');
* subContent.textContent = 'This came from MySubClass';
* memoizedTemplate.content.appendChild(subContent);
@@ -386,17 +407,43 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
* @return {HTMLTemplateElement|string} Template to be stamped
*/
static get template() {
// Explanation of template-related properties:
// - constructor.template (this getter): the template for the class.
// This can come from the prototype (for legacy elements), from a
// dom-module, or from the super class's template (or can be overridden
// altogether by the user)
// - constructor._template: memoized version of constructor.template
// - prototype._template: working template for the element, which will be
// parsed and modified in place. It is a cloned version of
// constructor.template, saved in _finalizeClass(). Note that before
// this getter is called, for legacy elements this could be from a
// _template field on the info object passed to Polymer(), a behavior,
// or set in registered(); once the static getter runs, a clone of it
// will overwrite it on the prototype as the working template.
if (!this.hasOwnProperty(JSCompiler_renameProperty('_template', this))) {
this._template = Polymer.DomModule && Polymer.DomModule.import(
/** @type {PolymerElementConstructor}*/ (this).is, 'template') ||
// note: implemented so a subclass can retrieve the super
// template; call the super impl this way so that `this` points
// to the superclass.
Object.getPrototypeOf(/** @type {PolymerElementConstructor}*/ (this).prototype).constructor.template;
this._template =
// If user has put template on prototype (e.g. in legacy via registered
// callback or info object), prefer that first
this.prototype.hasOwnProperty(JSCompiler_renameProperty('_template', this.prototype)) ?
this.prototype._template :
// Look in dom-module associated with this element's is
(getTemplateFromDomModule(/** @type {PolymerElementConstructor}*/ (this).is) ||
// Next look for superclass template (call the super impl this
// way so that `this` points to the superclass)
Object.getPrototypeOf(/** @type {PolymerElementConstructor}*/ (this).prototype).constructor.template);
}
return this._template;
}
/**
* Set the template.
*
* @param {!HTMLTemplateElement|string} value Template to set.
*/
static set template(value) {
this._template = value;
}
/**
* Path matching the url from which the element was imported.
*
@@ -404,7 +451,7 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
* The `importPath` property is also set on element instances and can be
* used to create bindings relative to the import path.
*
* For elements defined in ES modules, users should implement
* For elements defined in ES modules, users should implement
* `static get importMeta() { return import.meta; }`, and the default
* implementation of `importPath` will return `import.meta.url`'s path.
* For elements defined in HTML imports, this getter will return the path
lib/utils/templatize.html
+6
View File
@@ -513,6 +513,12 @@ subject to an additional IP rights grant found at http://polymer.github.io/PATEN
* @suppress {invalidCasts}
*/
templatize(template, owner, options) {
// Under strictTemplatePolicy, the templatized element must be owned
// by a (trusted) Polymer element, indicated by existence of _methodHost;
// e.g. for dom-if & dom-repeat in main document, _methodHost is null
if (Polymer.strictTemplatePolicy && !findMethodHost(template)) {
throw new Error('strictTemplatePolicy: template owner not trusted');
}
options = /** @type {!TemplatizeOptions} */(options || {});
if (template.__templatizeOwner) {
throw new Error('A <template> can only be templatized once');