fix($sanitize): sanitize javascript urls with comments

Closes #8274
angular · Aug 19, 2014 · b7e82a3 · b7e82a3
1 parent 6fdaa3d
commit b7e82a3
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/src/ng/sanitizeUri.js b/src/ng/sanitizeUri.js
@@ -6,7 +6,7 @@
  */
 function $$SanitizeUriProvider() {
   var aHrefSanitizationWhitelist = /^\s*(https?|ftp|mailto|tel|file):/,
-    imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file|blob):|data:image\//;
+    imgSrcSanitizationWhitelist = /^\s*((https?|ftp|file|blob):|data:image\/)/;
 
   /**
    * @description

diff --git a/test/ng/sanitizeUriSpec.js b/test/ng/sanitizeUriSpec.js
@@ -30,6 +30,11 @@ describe('sanitizeUri', function() {
       expect(sanitizeImg(testUrl)).toBe('unsafe:javascript:doEvilStuff()');
     });
 
+    it('should sanitize javascript: urls with comments', function() {
+      testUrl = "javascript:alert(1)//data:image/";
+      expect(sanitizeImg(testUrl)).toBe('unsafe:javascript:alert(1)//data:image/');
+    });
+
     it('should sanitize non-image data: urls', function() {
       testUrl = "data:application/javascript;charset=US-ASCII,alert('evil!');";
       expect(sanitizeImg(testUrl)).toBe("unsafe:data:application/javascript;charset=US-ASCII,alert('evil!');");