AngularJS 中文手册
简体中文(ZH-CN) English(EN) 繁体中文(ZH-TW) 日本語(JA) 한국어(KO) Melayu(MS) Français(FR) Deutsch(DE)
目錄 搜尋
AngularJS API Reference auto auto/service auto/service/$injector auto/service/$provide ng ng/directive ng/directive/a ng/directive/form ng/directive/input ng/directive/input[checkbox] ng/directive/input[date] ng/directive/input[dateTimeLocal] ng/directive/input[email] ng/directive/input[month] ng/directive/input[number] ng/directive/input[radio] ng/directive/input[text] ng/directive/input[time] ng/directive/input[url] ng/directive/input[week] ng/directive/ngApp ng/directive/ngBind ng/directive/ngBindHtml ng/directive/ngBindTemplate ng/directive/ngBlur ng/directive/ngChange ng/directive/ngChecked ng/directive/ngClass ng/directive/ngClassEven ng/directive/ngClassOdd ng/directive/ngClick ng/directive/ngCloak ng/directive/ngController ng/directive/ngCopy ng/directive/ngCsp ng/directive/ngCut ng/directive/ngDblclick ng/directive/ngDisabled ng/directive/ngFocus ng/directive/ngForm ng/directive/ngHide ng/directive/ngHref ng/directive/ngIf ng/directive/ngInclude ng/directive/ngInit ng/directive/ngKeydown ng/directive/ngKeypress ng/directive/ngKeyup ng/directive/ngList ng/directive/ngModel ng/directive/ngModelOptions ng/directive/ngMousedown ng/directive/ngMouseenter ng/directive/ngMouseleave ng/directive/ngMousemove ng/directive/ngMouseover ng/directive/ngMouseup ng/directive/ngNonBindable ng/directive/ngOpen ng/directive/ngPaste ng/directive/ngPluralize ng/directive/ngReadonly ng/directive/ngRepeat ng/directive/ngSelected ng/directive/ngShow ng/directive/ngSrc ng/directive/ngSrcset ng/directive/ngStyle ng/directive/ngSubmit ng/directive/ngSwitch ng/directive/ngTransclude ng/directive/ngValue ng/directive/script ng/directive/select ng/directive/textarea ng/filter ng/filter/currency ng/filter/date ng/filter/filter ng/filter/json ng/filter/limitTo ng/filter/lowercase ng/filter/number ng/filter/orderBy ng/filter/uppercase ng/function ng/function/angular.bind ng/function/angular.bootstrap ng/function/angular.copy ng/function/angular.element ng/function/angular.equals ng/function/angular.extend ng/function/angular.forEach ng/function/angular.fromJson ng/function/angular.identity ng/function/angular.injector ng/function/angular.isArray ng/function/angular.isDate ng/function/angular.isDefined ng/function/angular.isElement ng/function/angular.isFunction ng/function/angular.isNumber ng/function/angular.isObject ng/function/angular.isString ng/function/angular.isUndefined ng/function/angular.lowercase ng/function/angular.module ng/function/angular.noop ng/function/angular.toJson ng/function/angular.uppercase ng/object ng/object/angular.version ng/provider ng/provider/$animateProvider ng/provider/$compileProvider ng/provider/$controllerProvider ng/provider/$filterProvider ng/provider/$httpProvider ng/provider/$interpolateProvider ng/provider/$locationProvider ng/provider/$logProvider ng/provider/$parseProvider ng/provider/$rootScopeProvider ng/provider/$sceDelegateProvider ng/provider/$sceProvider ng/service ng/service/$anchorScroll ng/service/$animate ng/service/$cacheFactory ng/service/$compile ng/service/$controller ng/service/$document ng/service/$exceptionHandler ng/service/$filter ng/service/$http ng/service/$httpBackend ng/service/$interpolate ng/service/$interval ng/service/$locale ng/service/$location ng/service/$log ng/service/$parse ng/service/$q ng/service/$rootElement ng/service/$rootScope ng/service/$sce ng/service/$sceDelegate ng/service/$templateCache ng/service/$timeout ng/service/$window ng/type ng/type/$cacheFactory.Cache ng/type/$compile.directive.Attributes ng/type/$rootScope.Scope ng/type/angular.Module ng/type/form.FormController ng/type/ngModel.NgModelController ngAnimate ngAnimate/provider ngAnimate/provider/$animateProvider ngAnimate/service ngAnimate/service/$animate ngCookies ngCookies/service ngCookies/service/$cookies ngCookies/service/$cookieStore ngMessages ngMessages/directive ngMessages/directive/ngMessage ngMessages/directive/ngMessages ngMock ngMock/function ngMock/function/angular.mock.dump ngMock/function/angular.mock.inject ngMock/function/angular.mock.module ngMock/object ngMock/object/angular.mock ngMock/provider ngMock/provider/$exceptionHandlerProvider ngMock/service ngMock/service/$exceptionHandler ngMock/service/$httpBackend ngMock/service/$interval ngMock/service/$log ngMock/service/$timeout ngMock/type ngMock/type/angular.mock.TzDate ngMockE2E ngMockE2E/service ngMockE2E/service/$httpBackend ngResource ngResource/service ngResource/service/$resource ngRoute ngRoute/directive ngRoute/directive/ngView ngRoute/provider ngRoute/provider/$routeProvider ngRoute/service ngRoute/service/$route ngRoute/service/$routeParams ngSanitize ngSanitize/filter ngSanitize/filter/linky ngSanitize/service ngSanitize/service/$sanitize ngTouch ngTouch/directive ngTouch/directive/ngClick ngTouch/directive/ngSwipeLeft ngTouch/directive/ngSwipeRight ngTouch/service ngTouch/service/$swipe

©
本文檔使用 php中文網手册 發布

文字

AngularJS: API: ng/provider/$sceDelegateProvider

$sceDelegateProvider

  1. - $sceDelegate
  2. - provider in module ng

$sceDelegateProvider提供者允许开发者配置$sceDelegate服务。它允许一个get/set 白名单和黑名单用于确保使用的获取Angular模板的URL是安全的。参见$sceDelegateProvider.resourceUrlWhitelist 和 $sceDelegateProvider.resourceUrlBlacklist

对于这个服务在Angular中的一些细节，请阅读Strict Contextual Escaping (SCE)。

示例: 考虑以下情况

  • 你的应用的url主机地址为http://myapp.example.com/
  • 但是你的一些模板存在其它域上，如http://srv01.assets.example.com/, http://srv02.assets.example.com/等。
  • 并且你有一个开放的重定向http://myapp.example.com/clickThru?...。

这种情况下的安全配置可能看起来像：

 angular.module('myApp', []).config(Function($sceDelegateProvider) {
   $sceDelegateProvider.resourceUrlWhitelist([
     // 允许相同来源资源载入。
     'self',
     // 允许从我们的assets域加载。注意 * 和 **之间的不同。
     'http://srv*.assets.example.com/**'
   ]);

   // 黑名单覆盖白名单，这样开放重定向在这会被阻止。
   $sceDelegateProvider.resourceUrlBlacklist([
     'http://myapp.example.com/clickThru**'
   ]);
 });

方法

  • resourceUrlWhitelist([whitelist]);

    Sets/Gets 信任资源URL们的白名单。

    参数

    参数 类型 详述
    whitelist
    (可选)
    		 Array

    当提供时，使用给出的值替换resourceUrlWhitelist。它必须是一个数组或null。这里会使用该数组的快照，所以数组未来的变化被忽略。

    注意: 一个空的白名单数组会阻止所有URL!

    返回值

    Array

    当前设置的白名单数组。

    没有白名单时的默认值被简单设为['self']，只允许相同来源的资源请求。

  • resourceUrlBlacklist([blacklist]);

    Sets/Gets 信任资源URL们的黑名单。

    参数

    参数 类型 详述
    blacklist
    (可选)
    		 Array

    当提供时，使用给出的值替换resourceUrlBlacklist。它必须是一个数组或null。这里会使用该数组的快照，所以数组未来的变化被忽略。

    黑名单典型的用法是用**阻止开放重定向(http://cwe.mitre.org/data/definitions/601.html)。
使用**处理您域中这些原本被信任的但实际上返回重定向域的内容。
最后，正如我们之前所说的黑名单会覆盖白名单。

    返回值

    Array

    当前设置的黑名单数组。

    没有白名单时的默认值被简单设为空数组(表示这里没有黑名单)。

上一篇： 下一篇：