40 lines
2.2 KiB
HTML
Executable file
40 lines
2.2 KiB
HTML
Executable file
<a href="http://github.com/angular/angular.js/tree/v1.2.0rc1/src/ng/directive/ngCsp.js#L3" class="view-source btn btn-action"><i class="icon-zoom-in"> </i> View source</a><a href="http://github.com/angular/angular.js/edit/master/src/ng/directive/ngCsp.js" class="improve-docs btn btn-primary"><i class="icon-edit"> </i> Improve this doc</a><h1><code ng:non-bindable="">ngCsp</code>
|
|
<div><span class="hint">directive in module <code ng:non-bindable="">ng</code>
|
|
</span>
|
|
</div>
|
|
</h1>
|
|
<div><h2 id="Description">Description</h2>
|
|
<div class="description"><div class="ng-directive-page ng-directive-ngcsp-page"><p>Enables <a href="https://developer.mozilla.org/en/Security/CSP">CSP (Content Security Policy)</a> support.</p>
|
|
<p>This is necessary when developing things like Google Chrome Extensions.</p>
|
|
<p>CSP forbids apps to use <code>eval</code> or <code>Function(string)</code> generated functions (among other things).
|
|
For us to be compatible, we just need to implement the "getterFn" in $parse without violating
|
|
any of these restrictions.</p>
|
|
<p>AngularJS uses <code>Function(string)</code> generated functions as a speed optimization. By applying <code>ngCsp</code>
|
|
it is be possible to opt into the CSP compatible mode. When this mode is on AngularJS will
|
|
evaluate all expressions up to 30% slower than in non-CSP mode, but no security violations will
|
|
be raised.</p>
|
|
<p>In order to use this feature put <code>ngCsp</code> directive on the root element of the application.</p>
|
|
</div></div>
|
|
<h2 id="Usage">Usage</h2>
|
|
<div class="usage">as attribute<pre class="prettyprint linenums"><html ng-csp>
|
|
...
|
|
</html></pre>
|
|
as class<pre class="prettyprint linenums"><html class="ng-csp">
|
|
...
|
|
</html></pre>
|
|
<h3 id="Directive.info">Directive info</h3>
|
|
<div class="directive-info"><ul><li>This directive executes at priority level 1000.</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<h2 id="Example">Example</h2>
|
|
<div class="example"><div class="ng-directive-page ng-directive-ngcsp-page"><p>This example shows how to apply the <code>ngCsp</code> directive to the <code>html</code> tag.
|
|
<pre class="prettyprint linenums">
|
|
<!doctype html>
|
|
<html ng-app ng-csp>
|
|
...
|
|
...
|
|
</html>
|
|
</pre>
|
|
</div></div>
|
|
</div>
|