cargdev/angular
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ivy): ensure sanitizer is not used when direct class application occurs (#33154)

Browse Source 
Prior to this patch, if a map-class binding is applied directly then
that value will be incorrectly provided a sanitizer even if there is no
sanitization present for an element.

PR Close #33154
This commit is contained in:
Matias Niemelä
2019-10-14 13:45:51 -07:00
committed by Miško Hevery
parent a86893c10f
commit 1cda80eb3a
5 changed files with 86 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
packages/core/src/render3/styling/bindings.ts
View File

@ -756,7 +756,7 @@ function applyStylingValue(
let valueToApply: string|null = unwrapSafeValue(value);
if (isStylingValueDefined(valueToApply)) {
valueToApply =
sanitizer ? sanitizer(prop, value, StyleSanitizeMode.SanitizeOnly) : valueToApply;
sanitizer ? sanitizer(prop, value, StyleSanitizeMode.ValidateAndSanitize) : valueToApply;
applyFn(renderer, element, prop, valueToApply, bindingIndex);
return true;
}
@ -771,8 +771,9 @@ function findAndApplyMapValue(
const p = getMapProp(map, i);
if (p === prop) {
let valueToApply = getMapValue(map, i);
valueToApply =
sanitizer ? sanitizer(prop, valueToApply, StyleSanitizeMode.SanitizeOnly) : valueToApply;
valueToApply = sanitizer ?
sanitizer(prop, valueToApply, StyleSanitizeMode.ValidateAndSanitize) :
valueToApply;
applyFn(renderer, element, prop, valueToApply, bindingIndex);
return true;
}