Skip to content

ci: Add tsec_test for all ng_module targets. #24066

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jan 6, 2022
Merged

ci: Add tsec_test for all ng_module targets. #24066

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1464189
ci: Add tsec_test for all ng_module targets.
uraj Dec 1, 2021
dc504cf
fixup! ci: Add tsec_test for all ng_module targets.
uraj Dec 8, 2021
3b68126
fixup! ci: Add tsec_test for all ng_module targets.
uraj Dec 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions goldens/BUILD.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
exports_files([
"size-test.yaml",
"tsec-exemption.json",
])
17 changes: 17 additions & 0 deletions goldens/tsec-exemption.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{
"ban-trustedtypes-createpolicy": [
"../src/material/icon/trusted-types.ts"
],
"ban-element-innerhtml-assignments": [
"../src/material/icon/icon-registry.ts"
],
"ban-element-setattribute": [
"../src/cdk/a11y/aria-describer/aria-reference.ts",
"../src/material-experimental/mdc-checkbox/checkbox.ts",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you know if any of these exceptions should be eventually removed, or do they all contain valid reasons for this exception

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ban-trustedtypes-createpolicy exception is expected. We won't be able to remove it until we have better support to create trusted types for SVG.

The ban-element-innerhtml-assignments exception is a false positive, because src/material/icon/trusted-types.ts defines its own TrustedTypes interface instead of pulling the type from the @types/trusted-types package. I'm not sure why it's coded that way, but technically it can be removed.

The "ban-element-setattribute" ones are tricky. I don't see anything that raise immediate alarms, but some of those exceptions are exposing the "setAttribute" interface to users of the the custom elements, which can be abused to bypass other checks (depending on the type of the underlying elements). Those are probably hard to remove, since it will require breaking changes to the programming interface of those custom elements. That said, so far we haven't seen XSS caused by those in google3, so it might not be a big issue.

"../src/material-experimental/mdc-list/interactive-list-base.ts",
"../src/material-experimental/mdc-progress-spinner/progress-spinner.ts",
"../src/material-experimental/mdc-slide-toggle/slide-toggle.ts",
"../src/material/icon/icon-registry.ts",
"../src/material/icon/icon.ts"
]
}
2 changes: 2 additions & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
"test": "node ./scripts/run-component-tests.js",
"test-local": "yarn -s test --local",
"test-firefox": "yarn -s test --firefox",
"test-tsec": "yarn bazelisk test //... --build_tag_filters=tsec --test_tag_filters=tsec",
"lint": "yarn -s tslint && yarn -s stylelint && yarn -s ownerslint && yarn -s ng-dev format changed --check",
"e2e": "bazel test //src/... --build_tag_filters=e2e --test_tag_filters=e2e --build_tests_only",
"deploy-dev-app": "node ./scripts/deploy-dev-app.js",
Expand Down Expand Up @@ -211,6 +212,7 @@
"stylelint": "^14.0.1",
"terser": "^5.9.0",
"ts-node": "^10.2.1",
"tsec": "0.2.1",
"tsickle": "0.39.1",
"tslint": "^6.1.3",
"tsutils": "^3.21.0",
Expand Down
9 changes: 9 additions & 0 deletions src/BUILD.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,3 +49,12 @@ ts_library(
name = "dev_mode_types",
srcs = ["dev-mode-types.d.ts"],
)

ts_config(
name = "tsec_config",
src = "tsconfig-tsec.json",
deps = [
":bazel-tsconfig-build.json",
"//goldens:tsec-exemption.json",
],
)
2 changes: 1 addition & 1 deletion src/cdk/a11y/focus-monitor/focus-monitor.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ export class FocusMonitor implements OnDestroy {
// Make a note of when the window regains focus, so we can
// restore the origin info for the focused element.
this._windowFocused = true;
this._windowFocusTimeoutId = setTimeout(() => (this._windowFocused = false));
this._windowFocusTimeoutId = window.setTimeout(() => (this._windowFocused = false));
};

/** Used to reference correct document/window */
Expand Down
2 changes: 1 addition & 1 deletion src/material-experimental/mdc-chips/chip-row.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ export class MatChipRow
}

// Wait to see if focus moves to the other gridcell
this._focusoutTimeout = setTimeout(() => {
this._focusoutTimeout = window.setTimeout(() => {
this._hasFocusInternal = false;
this._onBlur.next({chip: this});
this._handleInteraction(event);
Expand Down
9 changes: 9 additions & 0 deletions src/tsconfig-tsec.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
{
"extends": "./bazel-tsconfig-build.json",
"compilerOptions": {
"plugins": [
{"name": "tsec", "exemptionConfig": "../goldens/tsec-exemption.json"}
]
}
}

18 changes: 18 additions & 0 deletions tools/defaults.bzl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ load("@npm//@bazel/jasmine:index.bzl", _jasmine_node_test = "jasmine_node_test")
load("@npm//@bazel/concatjs:index.bzl", _karma_web_test = "karma_web_test", _karma_web_test_suite = "karma_web_test_suite")
load("@npm//@bazel/protractor:index.bzl", _protractor_web_test_suite = "protractor_web_test_suite")
load("@npm//@bazel/typescript:index.bzl", _ts_library = "ts_library")
load("@npm//tsec:index.bzl", _tsec_test = "tsec_test")
load("//:packages.bzl", "NO_STAMP_NPM_PACKAGE_SUBSTITUTIONS", "NPM_PACKAGE_SUBSTITUTIONS")
load("//:pkg-externals.bzl", "PKG_EXTERNALS")
load("//tools/markdown-to-html:index.bzl", _markdown_to_html = "markdown_to_html")
Expand All @@ -31,6 +32,17 @@ integration_test = _integration_test
esbuild = _esbuild
esbuild_config = _esbuild_config

def _make_tsec_test(target):
package_name = native.package_name()
if not package_name.startswith("src/components-examples") and \
not package_name.endswith("/testing") and \
not package_name.endswith("/schematics"):
_tsec_test(
name = target + "_tsec_test",
target = target,
tsconfig = "//src:tsec_config",
)

def _compute_module_name(testonly):
current_pkg = native.package_name()

Expand Down Expand Up @@ -109,6 +121,9 @@ def ts_library(
**kwargs
)

if module_name and not testonly:
_make_tsec_test(kwargs["name"])

def ng_module(
deps = [],
srcs = [],
Expand Down Expand Up @@ -147,6 +162,9 @@ def ng_module(
**kwargs
)

if module_name and not testonly:
_make_tsec_test(kwargs["name"])

def ng_package(name, data = [], deps = [], externals = PKG_EXTERNALS, readme_md = None, visibility = None, **kwargs):
# If no readme file has been specified explicitly, use the default readme for
# release packages from "src/README.md".
Expand Down
10 changes: 9 additions & 1 deletion yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11256,7 +11256,7 @@ minimalistic-assert@^1.0.0, minimalistic-assert@^1.0.1:
resolved "https://registry.yarnpkg.com/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz#2e194de044626d4a10e7f7fbc00ce73e83e4d5c7"
integrity sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==

"minimatch@2 || 3", [email protected], minimatch@^3.0.2, minimatch@^3.0.4:
"minimatch@2 || 3", [email protected], minimatch@^3.0.2, minimatch@^3.0.3, minimatch@^3.0.4:
version "3.0.4"
resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.0.4.tgz#5166e286457f03306064be5497e8dbb0c3d32083"
integrity sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==
Expand Down Expand Up @@ -15642,6 +15642,14 @@ ts-node@^10.2.1:
make-error "^1.1.1"
yn "3.1.1"

[email protected]:
version "0.2.1"
resolved "https://registry.yarnpkg.com/tsec/-/tsec-0.2.1.tgz#017423174b2be54f26da5cb7591dc7035996086b"
integrity sha512-RP9vhbRbRI9VH4CfOlQvo5W9HdfiPKq0gdiUOWI5oKmLaZKNFN8CsPwBfT5ySmhnKNwmmAS/BtY3WoTfABwwig==
dependencies:
glob "^7.1.1"
minimatch "^3.0.3"

[email protected]:
version "0.39.1"
resolved "https://registry.yarnpkg.com/tsickle/-/tsickle-0.39.1.tgz#7ccf672cde5b430f5dd0b281ee49e170ef390ff9"
Expand Down