diff options
Diffstat (limited to 'docs/content/error/$sce')
| -rw-r--r-- | docs/content/error/$sce/icontext.ngdoc | 8 | ||||
| -rw-r--r-- | docs/content/error/$sce/iequirks.ngdoc | 17 | ||||
| -rw-r--r-- | docs/content/error/$sce/imatcher.ngdoc | 9 | ||||
| -rw-r--r-- | docs/content/error/$sce/insecurl.ngdoc | 26 | ||||
| -rw-r--r-- | docs/content/error/$sce/itype.ngdoc | 8 | ||||
| -rw-r--r-- | docs/content/error/$sce/iwcard.ngdoc | 9 | ||||
| -rw-r--r-- | docs/content/error/$sce/unsafe.ngdoc | 15 |
7 files changed, 92 insertions, 0 deletions
diff --git a/docs/content/error/$sce/icontext.ngdoc b/docs/content/error/$sce/icontext.ngdoc new file mode 100644 index 00000000..e30b6ad4 --- /dev/null +++ b/docs/content/error/$sce/icontext.ngdoc @@ -0,0 +1,8 @@ +@ngdoc error +@name $sce:icontext +@fullName Invalid / Unknown SCE context +@description + +The context enum passed to {@link ng.$sce#methods_trustAs $sce.trustAs} was not recognized. + +Please consult the list of {@link ng.$sce#contexts supported Strict Contextual Escaping (SCE) contexts}. diff --git a/docs/content/error/$sce/iequirks.ngdoc b/docs/content/error/$sce/iequirks.ngdoc new file mode 100644 index 00000000..08afbf66 --- /dev/null +++ b/docs/content/error/$sce/iequirks.ngdoc @@ -0,0 +1,17 @@ +@ngdoc error +@name $sce:iequirks +@fullName IE8 in quirks mode is unsupported +@description + +This error occurs when you are using AngularJS with {@link ng.$sce Strict Contextual Escaping (SCE)} mode enabled (the default) on IE8 or lower in quirks mode. + +In this mode, IE8 allows one to execute arbitrary javascript by the use of the `expression()` syntax and is not supported. +Refer +[MSDN Blogs > IEBlog > Ending Expressions](http://blogs.msdn.com/b/ie/archive/2008/10/16/ending-expressions.aspx) +to learn more about them. + +To resolve this error please specify the proper doctype at the top of your main html document: + +``` +<!doctype html> +``` diff --git a/docs/content/error/$sce/imatcher.ngdoc b/docs/content/error/$sce/imatcher.ngdoc new file mode 100644 index 00000000..eabdbc53 --- /dev/null +++ b/docs/content/error/$sce/imatcher.ngdoc @@ -0,0 +1,9 @@ +@ngdoc error +@name $sce:imatcher +@fullName Invalid matcher (only string patterns and RegExp instances are supported) +@description + +Please see {@link ng.$sceDelegateProvider#methods_resourceUrlWhitelist +$sceDelegateProvider.resourceUrlWhitelist} and {@link +api/ng.$sceDelegateProvider#methods_resourceUrlBlacklist $sceDelegateProvider.resourceUrlBlacklist} for the +list of acceptable items. diff --git a/docs/content/error/$sce/insecurl.ngdoc b/docs/content/error/$sce/insecurl.ngdoc new file mode 100644 index 00000000..67bbb2b6 --- /dev/null +++ b/docs/content/error/$sce/insecurl.ngdoc @@ -0,0 +1,26 @@ +@ngdoc error +@name $sce:insecurl +@fullName Processing of a Resource from Untrusted Source Blocked +@description + +AngularJS' {@link ng.$sce Strict Contextual Escaping (SCE)} mode (enabled by default) has blocked loading a resource from an insecure URL. + +Typically, this would occur if you're attempting to load an Angular template from an untrusted source. +It's also possible that a custom directive threw this error for a similar reason. + +Angular only loads templates from trusted URLs (by calling {@link ng.$sce#methods_getTrustedResourceUrl $sce.getTrustedResourceUrl} on the template URL). + +By default, only URLs that belong to the same origin are trusted. These are urls with the same domain and protocol as the application document. + +The {@link ng.directive:ngInclude ngInclude} directive and {@link guide/directive directives} that specify a `templateUrl` require a trusted resource URL. + +To load templates from other domains and/or protocols, either adjust the {@link +api/ng.$sceDelegateProvider#methods_resourceUrlWhitelist whitelist}/ {@link +api/ng.$sceDelegateProvider#methods_resourceUrlBlacklist blacklist} or wrap the URL with a call to {@link +api/ng.$sce#methods_trustAsResourceUrl $sce.trustAsResourceUrl}. + +**Note**: The browser's [Same Origin +Policy](https://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_XMLHttpRequest) and +[Cross-Origin Resource Sharing (CORS)](http://www.w3.org/TR/cors/) policy apply +that may further restrict whether the template is successfully loaded. (e.g. neither cross-domain +requests won't work on all browsers nor `file://` requests on some browsers) diff --git a/docs/content/error/$sce/itype.ngdoc b/docs/content/error/$sce/itype.ngdoc new file mode 100644 index 00000000..cc2a6f62 --- /dev/null +++ b/docs/content/error/$sce/itype.ngdoc @@ -0,0 +1,8 @@ +@ngdoc error +@name $sce:itype +@fullName String Value is Required for SCE Trust Call +@description + +{@link ng.$sce#methods_trustAs $sce.trustAs} requires a string value. + +Read more about {@link ng.$sce Strict Contextual Escaping (SCE)} in AngularJS. diff --git a/docs/content/error/$sce/iwcard.ngdoc b/docs/content/error/$sce/iwcard.ngdoc new file mode 100644 index 00000000..83facf1d --- /dev/null +++ b/docs/content/error/$sce/iwcard.ngdoc @@ -0,0 +1,9 @@ +@ngdoc error +@name $sce:iwcard +@fullName The sequence *** is not a valid pattern wildcard +@description + +The strings in {@link ng.$sceDelegateProvider#methods_resourceUrlWhitelist +$sceDelegateProvider.resourceUrlWhitelist} and {@link +api/ng.$sceDelegateProvider#methods_resourceUrlBlacklist $sceDelegateProvider.resourceUrlBlacklist} may not +contain the undefined sequence `***`. Only `*` and `**` wildcard patterns are defined. diff --git a/docs/content/error/$sce/unsafe.ngdoc b/docs/content/error/$sce/unsafe.ngdoc new file mode 100644 index 00000000..fdddf61b --- /dev/null +++ b/docs/content/error/$sce/unsafe.ngdoc @@ -0,0 +1,15 @@ +@ngdoc error +@name $sce:unsafe +@fullName Require a safe/trusted value +@description + +The value provided for use in a specific context was not found to be safe/trusted for use. + +Angular's {@link ng.$sce Strict Contextual Escaping (SCE)} mode +(enabled by default), requires bindings in certain +contexts to result in a value that is trusted as safe for use in such a context. (e.g. loading an +Angular template from a URL requires that the URL is one considered safe for loading resources.) + +This helps prevent XSS and other security issues. Read more at {@link +api/ng.$sce Strict Contextual Escaping (SCE)} + |