Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

Commit c71e082

Browse files
committed
fix(IE): Embrace canonicalization of ng-src specified URLs.
I'm not really sure why they weren't in the first place, but now they really are, and that doesn't seem like a negative change.
1 parent 21a02e7 commit c71e082

File tree

5 files changed

+25
-29
lines changed

5 files changed

+25
-29
lines changed

src/ng/compile.js

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1429,7 +1429,6 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
14291429

14301430
nodeName = nodeName_(this.$$element);
14311431

1432-
14331432
// img[srcset] is a bit too weird of a beast to handle through $sce.
14341433
// Instead, for now at least, sanitize each of the URIs individually.
14351434
// That works even dynamically, but it's not bypassable through the $sce.

src/ng/directive/attrs.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -415,7 +415,7 @@ forEach(['src', 'srcset', 'href'], function(attrName) {
415415
// on IE, if "ng:src" directive declaration is used and "src" attribute doesn't exist
416416
// then calling element.setAttribute('src', 'foo') doesn't do anything, so we need
417417
// to set the property as well to achieve the desired effect.
418-
// we use attr[attrName] value since $set can sanitize the url.
418+
// we reuse the value put in attr[name] since $set might have sanitized the url.
419419
if (msie && propName) element.prop(propName, attr[name]);
420420
});
421421
}

src/ng/sce.js

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -527,9 +527,6 @@ function $SceDelegateProvider() {
527527
* call `$sce.trustAs` on them (remember to include the `ngSanitize` module) (e.g.
528528
* `<div ng-bind-html="'<b>implicitly trusted</b>'"></div>`) just works.
529529
*
530-
* Additionally, `a[href]` and `img[src]` automatically sanitize their URLs and do not pass them
531-
* through {@link ng.$sce#getTrusted $sce.getTrusted}. SCE doesn't play a role here.
532-
*
533530
* The included {@link ng.$sceDelegate $sceDelegate} comes with sane defaults to allow you to load
534531
* templates in `ng-include` from your application's domain without having to even know about SCE.
535532
* It blocks loading templates from other domains or loading templates over http from an https

test/ng/compileSpec.js

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9722,12 +9722,14 @@ describe('$compile', function() {
97229722
inject(function($compile, $rootScope, $sce) {
97239723

97249724
element = $compile('<img src="{{testUrl}}"></img>')($rootScope);
9725-
$rootScope.testUrl = $sce.trustAsUrl('javascript:foo();');
9725+
// Assigning javascript:foo to src makes at least IE9-11 complain, so use another
9726+
// protocol name.
9727+
$rootScope.testUrl = $sce.trustAsUrl('someUnsafeThing:foo();');
97269728

97279729
$$sanitizeUri.and.throwError('Should not have been called');
97289730
$rootScope.$apply();
97299731

9730-
expect(element.attr('src')).toEqual('javascript:foo();');
9732+
expect(element.attr('src')).toEqual('someUnsafeThing:foo();');
97319733
});
97329734
});
97339735
});

test/ng/directive/booleanAttrsSpec.js

Lines changed: 20 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -191,34 +191,32 @@ describe('ngSrc', function() {
191191
}));
192192

193193

194-
if (msie) {
195-
it('should update the element property as well as the attribute', inject(
196-
function($compile, $rootScope, $sce) {
197-
// on IE, if "ng:src" directive declaration is used and "src" attribute doesn't exist
198-
// then calling element.setAttribute('src', 'foo') doesn't do anything, so we need
199-
// to set the property as well to achieve the desired effect
194+
it('should update the element property as well as the attribute', inject(
195+
function($compile, $rootScope, $sce) {
196+
// on IE, if "ng:src" directive declaration is used and "src" attribute doesn't exist
197+
// then calling element.setAttribute('src', 'foo') doesn't do anything, so we need
198+
// to set the property as well to achieve the desired effect
200199

201-
var element = $compile('<img ng-src="{{id}}"></img>')($rootScope);
200+
var element = $compile('<img ng-src="{{id}}"></img>')($rootScope);
202201

203-
$rootScope.$digest();
204-
expect(element.prop('src')).toBeUndefined();
205-
dealoc(element);
202+
$rootScope.$digest();
203+
expect(element.prop('src')).toBe('');
204+
dealoc(element);
206205

207-
element = $compile('<img ng-src="some/"></img>')($rootScope);
206+
element = $compile('<img ng-src="some/"></img>')($rootScope);
208207

209-
$rootScope.$digest();
210-
expect(element.prop('src')).toEqual('some/');
211-
dealoc(element);
208+
$rootScope.$digest();
209+
expect(element.prop('src')).toContain('some/');
210+
dealoc(element);
212211

213-
element = $compile('<img ng-src="{{id}}"></img>')($rootScope);
214-
$rootScope.$apply(function() {
215-
$rootScope.id = $sce.trustAsResourceUrl('http://somewhere');
216-
});
217-
expect(element.prop('src')).toEqual('http://somewhere');
212+
element = $compile('<img ng-src="{{id}}"></img>')($rootScope);
213+
$rootScope.$apply(function() {
214+
$rootScope.id = $sce.trustAsResourceUrl('http://somewhere');
215+
});
216+
expect(element.prop('src')).toEqual('http://somewhere/');
218217

219-
dealoc(element);
220-
}));
221-
}
218+
dealoc(element);
219+
}));
222220
});
223221

224222

0 commit comments

Comments
 (0)