kylefang/angular.js
1
0
Fork 0
mirror of https://github.com/zhigang1992/angular.js.git synced 2026-04-22 10:49:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(): whitelist blob urls for sanitization of data-bound image urls

Browse Source 
Closes #4623
This commit is contained in:
Igor Minar
2014-03-10 01:39:15 -07:00
parent b700282ffd
commit 47ab8df455
2 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/ng/sanitizeUri.js
View File

@@ -6,7 +6,7 @@
*/
function $$SanitizeUriProvider() {
var aHrefSanitizationWhitelist = /^\s*(https?|ftp|mailto|tel|file):/,
imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file):|data:image\//;
imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file|blob):|data:image\//;
/**
* @description

20
test/ng/sanitizeUriSpec.js
View File

@@ -37,13 +37,6 @@ describe('sanitizeUri', function() {
expect(sanitizeImg(testUrl)).toBe("unsafe:data:,foo");
});
it('should not sanitize data: URIs for images', function() {
// image data uri
// ref: http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever
testUrl = "data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==";
expect(sanitizeImg(testUrl)).toBe('data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==');
});
it('should sanitize mailto: urls', function() {
testUrl = "mailto:foo@bar.com";
expect(sanitizeImg(testUrl)).toBe('unsafe:mailto:foo@bar.com');
@@ -113,6 +106,17 @@ describe('sanitizeUri', function() {
expect(sanitizeImg(testUrl)).toBe('file:///foo/bar.html');
});
it('should not sanitize blob urls', function() {
testUrl = "blob:///foo/bar.html";
expect(sanitizeImg(testUrl)).toBe('blob:///foo/bar.html');
});
it('should not sanitize data: URIs for images', function() {
// image data uri
// ref: http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever
testUrl = "data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==";
expect(sanitizeImg(testUrl)).toBe('data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==');
});
it('should allow reconfiguration of the src whitelist', function() {
var returnVal;
@@ -227,4 +231,4 @@ describe('sanitizeUri', function() {
});
});
});