fix(core): set ngDevMode to false when calling enableProdMode()

[alan-agius4]

Currently, the global ngDevMode is set to false when using the Angular CLI optimization option. This option sets the globals via terser using the Compiler CLI private tooling API

angular/packages/compiler-cli/src/tooling.ts

Lines 25 to 34 in d39d64c

	export const GLOBAL_DEFS_FOR_TERSER = {
	ngDevMode: false,
	ngI18nClosureMode: false,
	};
	export const GLOBAL_DEFS_FOR_TERSER_WITH_AOT = {
	...GLOBAL_DEFS_FOR_TERSER,
	ngJitMode: false,
	};

.

It is not documented that users not using the Angular CLI or using Angular Universal without optimization need to manually set to false as otherwise they will be vulnerable to XHR attacks.

The ngDevMode description also mentions that calling enableProdMode will set the value to false.

angular/packages/core/src/util/ng_dev_mode.ts

Line 22 in 4610093

* - The user calls `enableProdMode()`.

which is currently not the case.

Closes #37644

[alan-agius4]

FYI: @kyliau and @mgechev.

[sod]

fixes #37644
fixes #36692

[IgorMinar]

lgtm

[AndrewKushnir]

Presubmit.

[AndrewKushnir]

FYI, presubmit went well for the changes in this PR.

@kyliau @alan-agius4 there are 2 target labels on this PR and the tooling does not support a single PR targeting multiple
trains/versions, see #40156. I will remove the "target: lts" for now (keeping just "target: patch") so this PR can be merged. Could you please create a separate PR if we need to land this change in LTS branch as well?

Thank you.

[alan-agius4]

Thanks @AndrewKushnir, I’ll create the PRs to target LTS branches tomorrow as I don’t have access to my laptop at the moment.

[kyliau]

cherry pick for v9 lts: #40159
cherry pick for v10 lts: #40160

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}