fix(core): synchronize core sanitization schema with compiler

Synchronizes the core's copy of the DOM security schema with the compiler-side schema definitions, and removes the write_source_file target.

Author: alan-agius4

packages/core/BUILD.bazel

@@ -1,5 +1,4 @@
 load("@build_bazel_rules_nodejs//:index.bzl", "generated_file_test")
-load("@bazel_lib//lib:write_source_files.bzl", "write_source_file")
 load("//adev/shared-docs/pipeline/api-gen:generate_api_docs.bzl", "generate_api_docs")
 load("//packages/common/locales:index.bzl", "generate_base_locale_file")
 load("//tools:defaults.bzl", "api_golden_test", "api_golden_test_npm_package", "ng_package", "tsec_test")
@@ -174,9 +173,4 @@ genrule(
     cmd = "cp $< $@",
 )
 
-write_source_file(
-    name = "dom_security_schema",
-    check_that_out_file_exists = False,
-    in_file = "//packages/compiler:src/schema/dom_security_schema.ts",
-    out_file = ":src/sanitization/dom_security_schema.ts",
-)
+

packages/core/src/sanitization/dom_security_schema.ts

@@ -115,20 +115,10 @@ export function SECURITY_SCHEMA(): {[k: string]: SecurityContext} {
       ['object', ['codebase', 'data']],
     ]);
 
-    // The below are for Script SVG
-    // See: https://developer.mozilla.org/en-US/docs/Web/API/SVGScriptElement/href
-    registerContext(SecurityContext.RESOURCE_URL, SVG_NAMESPACE, [
-      ['script', ['src', 'href', 'xlink:href']],
-    ]);
-
     registerContext(SecurityContext.URL, SVG_NAMESPACE, [['a', ['href', 'xlink:href']]]);
 
     // Keep this in sync with SECURITY_SENSITIVE_ELEMENTS in packages/core/src/sanitization/sanitization.ts
-    // The `unknown` elements refer to cases when we need to validate the input/binding in a directive (host bindings)
-    // and the directive can be applied to multiple different elements (with different tag names). In this case we generate
-    // a special instruction that an attribute might potentially be security-sensitive and defer the actual security check
-    // to runtime, when we apply that directive to a concrete elements, thus we can check the combination of tag+attribute
-    // against the set that requires sanitization.
+    // Unknown is the internal tag name for unknown elements example used for host-bindings.
     // These are unsafe as `attributeName` can be `href` or `xlink:href`
     // See: http://b/463880509#comment7
     registerContext(SecurityContext.ATTRIBUTE_NO_BINDING, SVG_NAMESPACE, [