This repository has been archived by the owner on Apr 12, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 27.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix($sanitize): Use same whitelist mechanism as $compile does.
`$sanitize` now uses the same mechanism as `$compile` to validate uris. By this, the validation in `$sanitize` is more general and can be configured in the same way as the one in `$compile`. Changes - Creates the new private service `$$sanitizeUri`. - Moves related specs from `compileSpec.js` into `sanitizeUriSpec.js`. - Refactors the `linky` filter to be less dependent on `$sanitize` internal functions. Fixes #3748.
- Loading branch information
Showing
9 changed files
with
550 additions
and
339 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| 'use strict'; | ||
|
|
||
| /** | ||
| * @description | ||
| * Private service to sanitize uris for links and images. Used by $compile and $sanitize. | ||
| */ | ||
| function $$SanitizeUriProvider() { | ||
| var aHrefSanitizationWhitelist = /^\s*(https?|ftp|mailto|tel|file):/, | ||
| imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file):|data:image\//; | ||
|
|
||
| /** | ||
| * @description | ||
| * Retrieves or overrides the default regular expression that is used for whitelisting of safe | ||
| * urls during a[href] sanitization. | ||
| * | ||
| * The sanitization is a security measure aimed at prevent XSS attacks via html links. | ||
| * | ||
| * Any url about to be assigned to a[href] via data-binding is first normalized and turned into | ||
| * an absolute url. Afterwards, the url is matched against the `aHrefSanitizationWhitelist` | ||
| * regular expression. If a match is found, the original url is written into the dom. Otherwise, | ||
| * the absolute url is prefixed with `'unsafe:'` string and only then is it written into the DOM. | ||
| * | ||
| * @param {RegExp=} regexp New regexp to whitelist urls with. | ||
| * @returns {RegExp|ng.$compileProvider} Current RegExp if called without value or self for | ||
| * chaining otherwise. | ||
| */ | ||
| this.aHrefSanitizationWhitelist = function(regexp) { | ||
| if (isDefined(regexp)) { | ||
| aHrefSanitizationWhitelist = regexp; | ||
| return this; | ||
| } | ||
| return aHrefSanitizationWhitelist; | ||
| }; | ||
|
|
||
|
|
||
| /** | ||
| * @description | ||
| * Retrieves or overrides the default regular expression that is used for whitelisting of safe | ||
| * urls during img[src] sanitization. | ||
| * | ||
| * The sanitization is a security measure aimed at prevent XSS attacks via html links. | ||
| * | ||
| * Any url about to be assigned to img[src] via data-binding is first normalized and turned into | ||
| * an absolute url. Afterwards, the url is matched against the `imgSrcSanitizationWhitelist` | ||
| * regular expression. If a match is found, the original url is written into the dom. Otherwise, | ||
| * the absolute url is prefixed with `'unsafe:'` string and only then is it written into the DOM. | ||
| * | ||
| * @param {RegExp=} regexp New regexp to whitelist urls with. | ||
| * @returns {RegExp|ng.$compileProvider} Current RegExp if called without value or self for | ||
| * chaining otherwise. | ||
| */ | ||
| this.imgSrcSanitizationWhitelist = function(regexp) { | ||
| if (isDefined(regexp)) { | ||
| imgSrcSanitizationWhitelist = regexp; | ||
| return this; | ||
| } | ||
| return imgSrcSanitizationWhitelist; | ||
| }; | ||
|
|
||
| this.$get = function() { | ||
| return function sanitizeUri(uri, isImage) { | ||
| var regex = isImage ? imgSrcSanitizationWhitelist : aHrefSanitizationWhitelist; | ||
| var normalizedVal; | ||
| // NOTE: urlResolve() doesn't support IE < 8 so we don't sanitize for that case. | ||
| if (!msie || msie >= 8 ) { | ||
| normalizedVal = urlResolve(uri).href; | ||
| if (normalizedVal !== '' && !normalizedVal.match(regex)) { | ||
| return 'unsafe:'+normalizedVal; | ||
| } | ||
| } | ||
| return uri; | ||
| }; | ||
| }; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
3335234There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@tbosch - the first character of the subject should be lower case, and there should be no full stop at the end:
fix($sanitize):
Uuse same whitelist mechanism as $compile does