docs: update links to use HTTPS as protocol #39718

Marcono1234 · 2020-11-16T21:46:52Z

PR Checklist

Please check if your PR fulfills the following requirements:

The commit message follows our guidelines: https://github.com/angular/angular/blob/master/CONTRIBUTING.md#commit

PR Type

What kind of change does this PR introduce?

Bugfix
Feature
Code style update (formatting, local variables)
Refactoring (no functional changes, no api changes)
Build related changes
CI related changes
Documentation content changes
angular.io application / infrastructure changes
Other... Please describe:

What is the current behavior?

Documentation, code comments and example and test code is using HTTP for links and URLs despite the target sites supporting HTTPS. When the user then opens the site, the browser first tries to create an unencrypted connection. An adversary in the same local network could abuse this.

What is the new behavior?

The links have been updated where the target site supports HTTPS (and is correctly configured); some links have been updated to their current redirect destination.

Note that this pull request might have missed a few cases. Additionally it is a draft for now to make sure that it does not break anything (since there are also a few code changes).
Though I do not mind if you think this effort is not worth it. Also feel free to pick the relevant edits from the pull request then, or let me know if you want something to be changed, or if you want this pull request to be split.

Does this PR introduce a breaking change?

Yes
No

I hope not.

Marcono1234 · 2020-11-16T21:49:40Z

aio/content/guide/security.md

+`Content-Security-Policy` HTTP header. Read more about content security policy at the 
+[Web Fundamentals page](https://developers.google.com/web/fundamentals/security/csp) on the
+Google Developers website.


Not sure if the wording here is good. The reason for this change is that http://www.html5rocks.com/en/tutorials/security/content-security-policy/ redirects to the Google Developers site.

I think "Web Fundamentals guide" is better. Other than that, everything sounds good to me.

Marcono1234 · 2020-11-16T21:54:17Z

aio/content/guide/deployment.md

@@ -222,7 +222,7 @@ modified to serve `index.html`:


 * [IIS](https://www.iis.net/): add a rewrite rule to `web.config`, similar to the one shown
-[here](http://stackoverflow.com/a/26152011/2116927):
+[here](https://stackoverflow.com/a/26152011):


I have removed the user ID at the end. Could be added again if that user wants badges 😄

Marcono1234 · 2020-11-16T21:55:51Z

aio/content/guide/forms.md

@@ -137,7 +137,7 @@ template using the `<app-hero-form>` tag.
   The **Submit** button has some classes on it for styling.
   At this point, the form  layout is all plain HTML5, with no bindings or directives.

-6. The sample form uses some style classes from [Twitter Bootstrap](http://getbootstrap.com/css/): `container`, `form-group`, `form-control`, and `btn`.
+6. The sample form uses some style classes from [Twitter Bootstrap](https://getbootstrap.com/css/): `container`, `form-group`, `form-control`, and `btn`.


Maybe this could also be changed to https://getbootstrap.com/, or a different link, in case this applies to version 4 as well. The current link leads to version 3.4.

gkalpak

This is amazing, @Marcono1234 ❤️
I could help taking a look, even if it's in draft state 😇

aio/content/guide/styleguide.md

aio/content/tutorial/toh-pt4.md

aio/tools/examples/shared/boilerplate/cli/.gitignore

aio/content/guide/glossary.md

aio/content/guide/schematics-authoring.md

packages/bazel/src/ng_module.bzl

modules/playground/src/hello_world/index.ts

packages/platform-browser/src/dom/events/hammer_gestures.ts

aio/content/guide/animations.md

Marcono1234 · 2020-11-18T18:10:52Z

I have force-pushed to fix a merge conflict by rebasing onto master; maybe it would have been better to merge master in instead, sorry.

I can also squash the commits at the end, but for now I think having them separate makes it easier to see the changes.

mary-poppins · 2020-11-18T19:40:41Z

You can preview e9fab14 at https://pr39718-e9fab14.ngbuilds.io/.
You can preview 700d266 at https://pr39718-700d266.ngbuilds.io/.
You can preview 6f1cfbd at https://pr39718-6f1cfbd.ngbuilds.io/.

gkalpak

Thx, @Marcono1234! One last comment and this should be good to go 🚀

We prefer rebasing over merging, so force-pushing to a PR branch is fine 😉

You are right that we will need the commits squashed eventually. A better way to keep incremental changes separate is using fixup commits. See here for more details. At this point, you could squash your existing commits into one and add any new changes to a fixup commit (so they are easier to review).

aio/content/guide/animations.md

Marcono1234 · 2020-11-19T18:21:28Z

packages/core/src/render3/i18n/i18n_parse.ts

-                        `${lowerAttrName} on element ${tagName} (see https://g.co/ng/security#xss)`);
+                        `${lowerAttrName} on element ${tagName} ` +
+                        `(see https://g.co/ng/security#xss)`);


The format task wanted to wrap this in a weird way:

console.warn( `WARNING: ignoring unsafe attribute value ` + `${lowerAttrName} on element ${ tagName} (see https://g.co/ng/security#xss)`);

I am not really familiar with TypeScript, but that did not look right to me so I manually wrapped it instead.

You should never argue with the formatter 😛
Your way is fine too, though, so heppy to go with that (as long as the formatter is happy).

gkalpak

🎉
Thx, @Marcono1234 ❤️

Reviewed-for: dev-infra, global-docs-approvers

gkalpak

Reviewed-for: dev-infra, global-docs-approvers

mhevery

reviewed-for: integration-tests

IgorMinar

wow.. nice cleanup. thank you, @Marcono1234!

Reviewed-for: global-approvers

Marcono1234 · 2020-11-19T20:47:40Z

No problem and thanks for the review comments!

It appears the CircleCI "Details" links require you to authenticate with your GitHub account, even though you just want to see the build logs. This is rather cumbersome, especially since CircleCI requests quite a lot permissions¹. Is this something you can control and potentially turn off?

1: Requested permissions:

"This application will be able to read and write all public repository data."
"This application will be able to read your organization, team membership, and private project boards."

gkalpak · 2020-11-20T09:21:10Z

Unfortunately that is not something we control 😞
We have raised it with CircleCI, so it's on them to fix it.

PR Close #39718

angular-automatic-lock-bot · 2020-12-22T16:44:29Z

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}

google-cla bot added the cla: yes label Nov 16, 2020

Marcono1234 changed the title ~~(docs|fix): update links, use HTTPS as protocol~~ docs|fix: update links, use HTTPS as protocol Nov 16, 2020

Marcono1234 commented Nov 16, 2020

View reviewed changes

gbumanzordev approved these changes Nov 17, 2020

View reviewed changes

gkalpak reviewed Nov 17, 2020

View reviewed changes

This comment has been minimized.

Sign in to view

google-cla bot added cla: no and removed cla: yes labels Nov 18, 2020

gkalpak added action: review The PR is still awaiting reviews from at least one requested reviewer aio: preview refactoring Issue that involves refactoring or code-cleanup target: patch This PR is targeted for the next patch release type: bug/fix labels Nov 18, 2020

ngbot bot modified the milestone: needsTriage Nov 18, 2020

gkalpak self-requested a review November 18, 2020 19:40

ngbot bot added this to the needsTriage milestone Nov 18, 2020

gkalpak requested changes Nov 18, 2020

View reviewed changes

aio/content/guide/animations.md Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

Marcono1234 marked this pull request as ready for review November 18, 2020 21:36

pullapprove bot requested review from alxhub, AndrewKushnir, atscott, IgorMinar and jelbourn November 18, 2020 21:36

fixup! docs: update links to use HTTPS as protocol

7088254

This comment has been minimized.

Sign in to view

Marcono1234 commented Nov 19, 2020

View reviewed changes

gkalpak added the action: rerun CI at HEAD label Nov 19, 2020

ngbot bot removed the action: rerun CI at HEAD label Nov 19, 2020

gkalpak approved these changes Nov 19, 2020

View reviewed changes

This comment has been minimized.

Sign in to view

google-cla bot added cla: yes and removed cla: no labels Nov 19, 2020

gkalpak approved these changes Nov 19, 2020

View reviewed changes

mhevery approved these changes Nov 19, 2020

View reviewed changes

IgorMinar approved these changes Nov 19, 2020

View reviewed changes

IgorMinar added action: merge The PR is ready for merge by the caretaker and removed action: review The PR is still awaiting reviews from at least one requested reviewer labels Nov 19, 2020

IgorMinar removed request for jelbourn, alxhub, AndrewKushnir and atscott November 19, 2020 20:13

AndrewKushnir added the action: presubmit The PR is in need of a google3 presubmit label Nov 19, 2020

IgorMinar removed the action: presubmit The PR is in need of a google3 presubmit label Nov 19, 2020

gkalpak changed the title ~~docs|fix: update links, use HTTPS as protocol~~ docs: update links to use HTTPS as protocol Nov 20, 2020

AndrewKushnir pushed a commit that referenced this pull request Nov 20, 2020

docs: update links to use HTTPS as protocol (#39718)

e32fe1a

PR Close #39718

AndrewKushnir closed this in 3e1e5a1 Nov 20, 2020

Marcono1234 deleted the marcono1234/update-links branch November 21, 2020 00:00

angular-automatic-lock-bot bot locked and limited conversation to collaborators Dec 22, 2020

pullapprove bot removed the comp: docs label Dec 22, 2020

ngbot bot removed this from the Backlog milestone Dec 22, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs: update links to use HTTPS as protocol #39718

docs: update links to use HTTPS as protocol #39718

Marcono1234 commented Nov 16, 2020

Marcono1234 Nov 16, 2020

gkalpak Nov 17, 2020

Marcono1234 Nov 16, 2020

Marcono1234 Nov 16, 2020

gkalpak left a comment

This comment has been minimized.

Marcono1234 commented Nov 18, 2020

mary-poppins commented Nov 18, 2020

gkalpak left a comment

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Marcono1234 Nov 19, 2020

gkalpak Nov 19, 2020

gkalpak left a comment •

edited

Loading

This comment has been minimized.

gkalpak left a comment

mhevery left a comment

IgorMinar left a comment

Marcono1234 commented Nov 19, 2020

gkalpak commented Nov 20, 2020

angular-automatic-lock-bot bot commented Dec 22, 2020

docs: update links to use HTTPS as protocol #39718

docs: update links to use HTTPS as protocol #39718

Conversation

Marcono1234 commented Nov 16, 2020

PR Checklist

PR Type

What is the current behavior?

What is the new behavior?

Does this PR introduce a breaking change?

Marcono1234 Nov 16, 2020

Choose a reason for hiding this comment

gkalpak Nov 17, 2020

Choose a reason for hiding this comment

Marcono1234 Nov 16, 2020

Choose a reason for hiding this comment

Marcono1234 Nov 16, 2020

Choose a reason for hiding this comment

gkalpak left a comment

Choose a reason for hiding this comment

This comment has been minimized.

Marcono1234 commented Nov 18, 2020

mary-poppins commented Nov 18, 2020

gkalpak left a comment

Choose a reason for hiding this comment

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Marcono1234 Nov 19, 2020

Choose a reason for hiding this comment

gkalpak Nov 19, 2020

Choose a reason for hiding this comment

gkalpak left a comment • edited Loading

Choose a reason for hiding this comment

This comment has been minimized.

gkalpak left a comment

Choose a reason for hiding this comment

mhevery left a comment

Choose a reason for hiding this comment

IgorMinar left a comment

Choose a reason for hiding this comment

Marcono1234 commented Nov 19, 2020

gkalpak commented Nov 20, 2020

angular-automatic-lock-bot bot commented Dec 22, 2020

gkalpak left a comment •

edited

Loading