text: goog.module('_angular$platform_browser$src$security$dom__sanitization__service');
  var core_1 = goog.require('_angular$core');
  var core_private_1 = goog.require('_angular$platform_browser$core__private');
  exports.SecurityContext = core_private_1.SecurityContext;
  var html_sanitizer_1 = goog.require('_angular$platform_browser$src$security$html__sanitizer');
  var url_sanitizer_1 = goog.require('_angular$platform_browser$src$security$url__sanitizer');
  var style_sanitizer_1 = goog.require('_angular$platform_browser$src$security$style__sanitizer');
  /**
   * DomSanitizationService helps preventing Cross Site Scripting Security bugs (XSS) by sanitizing
   * values to be safe to use in the different DOM contexts.
   *
   * For example, when binding a URL in an `<a [href]="someValue">` hyperlink, `someValue` will be
   * sanitized so that an attacker cannot inject e.g. a `javascript:` URL that would execute code on
   * the website.
   *
   * In specific situations, it might be necessary to disable sanitization, for example if the
   * application genuinely needs to produce a `javascript:` style link with a dynamic value in it.
   * Users can bypass security by constructing a value with one of the `bypassSecurityTrust...`
   * methods, and then binding to that value from the template.
   *
   * These situations should be very rare, and extraordinary care must be taken to avoid creating a
   * Cross Site Scripting (XSS) security bug!
   *
   * When using `bypassSecurityTrust...`, make sure to call the method as early as possible and as
   * close as possible to the source of the value, to make it easy to verify no security bug is
   * created by its use.
   *
   * It is not required (and not recommended) to bypass security if the value is safe, e.g. a URL that
   * does not start with a suspicious protocol, or an HTML snippet that does not contain dangerous
   * code. The sanitizer leaves safe values intact.
   */
  class DomSanitizationService {
  }
  exports.DomSanitizationService = DomSanitizationService;
  class DomSanitizationServiceImpl extends DomSanitizationService {
      /**
       * @param {?} ctx
       * @param {?} value
       * @return {?}
       */
      sanitize(ctx, value) {
          if (value == null)
              return null;
          switch (ctx) {
              case core_private_1.SecurityContext.NONE:
                  return value;
              case core_private_1.SecurityContext.HTML:
                  if (value instanceof SafeHtmlImpl)
                      return value.changingThisBreaksApplicationSecurity;
                  this.checkNotSafeValue(value, 'HTML');
                  return html_sanitizer_1.sanitizeHtml(String(value));
              case core_private_1.SecurityContext.STYLE:
                  if (value instanceof SafeStyleImpl)
                      return value.changingThisBreaksApplicationSecurity;
                  this.checkNotSafeValue(value, 'Style');
                  return style_sanitizer_1.sanitizeStyle(value);
              case core_private_1.SecurityContext.SCRIPT:
                  if (value instanceof SafeScriptImpl)
                      return value.changingThisBreaksApplicationSecurity;
                  this.checkNotSafeValue(value, 'Script');
                  throw new Error('unsafe value used in a script context');
              case core_private_1.SecurityContext.URL:
                  if (value instanceof SafeUrlImpl)
                      return value.changingThisBreaksApplicationSecurity;
                  this.checkNotSafeValue(value, 'URL');
                  return url_sanitizer_1.sanitizeUrl(String(value));
              case core_private_1.SecurityContext.RESOURCE_URL:
                  if (value instanceof SafeResourceUrlImpl) {
                      return value.changingThisBreaksApplicationSecurity;
                  }
                  this.checkNotSafeValue(value, 'ResourceURL');
                  throw new Error('unsafe value used in a resource URL context');
              default:
                  throw new Error(`Unexpected SecurityContext ${ctx}`);
          }
      }
      /**
       * @param {?} value
       * @param {?} expectedType
       * @return {?}
       */
      checkNotSafeValue(value, expectedType) {
          if (value instanceof SafeValueImpl) {
              throw new Error('Required a safe ' + expectedType + ', got a ' + value.getTypeName());
          }
      }
      /**
       * @param {?} value
       * @return {?}
       */
      bypassSecurityTrustHtml(value) { return new SafeHtmlImpl(value); }
      /**
       * @param {?} value
       * @return {?}
       */
      bypassSecurityTrustStyle(value) { return new SafeStyleImpl(value); }
      /**
       * @param {?} value
       * @return {?}
       */
      bypassSecurityTrustScript(value) { return new SafeScriptImpl(value); }
      /**
       * @param {?} value
       * @return {?}
       */
      bypassSecurityTrustUrl(value) { return new SafeUrlImpl(value); }
      /**
       * @param {?} value
       * @return {?}
       */
      bypassSecurityTrustResourceUrl(value) {
          return new SafeResourceUrlImpl(value);
      }
  }
  DomSanitizationServiceImpl.decorators = [
      { type: core_1.Injectable },
  ];
  exports.DomSanitizationServiceImpl = DomSanitizationServiceImpl;
  class SafeValueImpl {
      /**
       * @param {?} changingThisBreaksApplicationSecurity
       */
      constructor(changingThisBreaksApplicationSecurity) {
          this.changingThisBreaksApplicationSecurity = changingThisBreaksApplicationSecurity;
          // empty
      }
      static _tsickle_typeAnnotationsHelper() {
          /** @type {?} */
          SafeValueImpl.prototype.changingThisBreaksApplicationSecurity;
      }
  }
  class SafeHtmlImpl extends SafeValueImpl {
      /**
       * @return {?}
       */
      getTypeName() { return 'HTML'; }
  }
  class SafeStyleImpl extends SafeValueImpl {
      /**
       * @return {?}
       */
      getTypeName() { return 'Style'; }
  }
  class SafeScriptImpl extends SafeValueImpl {
      /**
       * @return {?}
       */
      getTypeName() { return 'Script'; }
  }
  class SafeUrlImpl extends SafeValueImpl {
      /**
       * @return {?}
       */
      getTypeName() { return 'URL'; }
  }
  class SafeResourceUrlImpl extends SafeValueImpl {
      /**
       * @return {?}
       */
      getTypeName() { return 'ResourceURL'; }
  }
  //# sourceMappingURL=dom_sanitization_service.js.map