diff options
| author | Dean Sofer | 2013-05-15 23:17:30 -0700 |
|---|---|---|
| committer | Pete Bacon Darwin | 2013-05-16 21:22:07 +0100 |
| commit | a380fc46247a5b61a71199a01670c751396881f5 (patch) | |
| tree | c52cabd230a07c151da851b4e30764b6b830facb /src/ng/directive/ngCsp.js | |
| parent | 99cd86a96ee2e076f96f5f5d26646b8f7b782a5e (diff) | |
| download | angular.js-a380fc46247a5b61a71199a01670c751396881f5.tar.bz2 | |
docs(ngCsp): add more informative details
Transferred from https://github.com/angular/angular.js/wiki/Using-AngularJS-in-a-Chrome-Extension-environment
Diffstat (limited to 'src/ng/directive/ngCsp.js')
| -rw-r--r-- | src/ng/directive/ngCsp.js | 32 |
1 files changed, 24 insertions, 8 deletions
diff --git a/src/ng/directive/ngCsp.js b/src/ng/directive/ngCsp.js index 16b1a0e3..4098e648 100644 --- a/src/ng/directive/ngCsp.js +++ b/src/ng/directive/ngCsp.js @@ -5,16 +5,32 @@ * @name ng.directive:ngCsp * @priority 1000 * + * @element html * @description * Enables [CSP (Content Security Policy)](https://developer.mozilla.org/en/Security/CSP) support. - * This directive should be used on the root element of the application (typically the `<html>` - * element or other element with the {@link ng.directive:ngApp ngApp} - * directive). - * - * If enabled the performance of template expression evaluator will suffer slightly, so don't enable - * this mode unless you need it. - * - * @element html + * + * This is necessary when developing things like Google Chrome Extensions. + * + * CSP forbids apps to use `eval` or `Function(string)` generated functions (among other things). + * For us to be compatible, we just need to implement the "getterFn" in $parse without violating + * any of these restrictions. + * + * AngularJS uses `Function(string)` generated functions as a speed optimization. By applying `ngCsp` + * it is be possible to opt into the CSP compatible mode. When this mode is on AngularJS will + * evaluate all expressions up to 30% slower than in non-CSP mode, but no security violations will + * be raised. + * + * In order to use this feature put `ngCsp` directive on the root element of the application. + * + * @example + * This example shows how to apply the `ngCsp` directive to the `html` tag. + <pre> + <!doctype html> + <html ng-app ng-csp> + ... + ... + </html> + </pre> */ var ngCspDirective = ['$sniffer', function($sniffer) { |