{
- const template = `
Text
`;
- TestBed.overrideComponent(SecuredComponent, {set: {template}});
- const fixture = TestBed.createComponent(SecuredComponent);
-
- const e = fixture.debugElement.children[0].nativeElement;
- const ci = fixture.componentInstance;
- // Make sure binding harmless values works.
- ci.ctxProp = 'red';
- fixture.detectChanges();
- // In some browsers, this will contain the full background specification, not just
- // the color.
- expect(e.style['background']).toMatch(/red.*/);
-
- ci.ctxProp = 'url(javascript:evil())';
- fixture.detectChanges();
- // Updated value gets rejected, no value change.
- expect(e.style['background']).not.toContain('javascript');
- });
-
modifiedInIvy('Unknown property error thrown during update mode, not creation mode')
.it('should escape unsafe SVG attributes', () => {
const template = `
Text`;
diff --git a/packages/core/test/render3/instructions/styling_spec.ts b/packages/core/test/render3/instructions/styling_spec.ts
index 8751b15bff..5b5ea5047f 100644
--- a/packages/core/test/render3/instructions/styling_spec.ts
+++ b/packages/core/test/render3/instructions/styling_spec.ts
@@ -242,32 +242,6 @@ describe('styling', () => {
expectStyle(div).toEqual({width: '200px'});
});
});
-
- describe('sanitization', () => {
- it('should sanitize property', () => {
- ɵɵstyleSanitizer(ɵɵsanitizeStyle);
- ɵɵstyleProp('background', 'url("javascript:/unsafe")');
- expect(div.style.getPropertyValue('background')).not.toContain('javascript');
-
- clearFirstUpdatePass();
-
- rewindBindingIndex();
- ɵɵstyleProp('background', bypassSanitizationTrustStyle('url("javascript:/trusted")'));
- expect(div.style.getPropertyValue('background')).toContain('url("javascript:/trusted")');
- });
-
- it('should sanitize map', () => {
- ɵɵstyleSanitizer(ɵɵsanitizeStyle);
- ɵɵstyleMap('background: url("javascript:/unsafe")');
- expect(div.style.getPropertyValue('background')).not.toContain('javascript');
-
- clearFirstUpdatePass();
-
- rewindBindingIndex();
- ɵɵstyleMap({'background': bypassSanitizationTrustStyle('url("javascript:/trusted")')});
- expect(div.style.getPropertyValue('background')).toContain('url("javascript:/trusted")');
- });
- });
});
describe('static', () => {
@@ -578,4 +552,4 @@ function expectTStylingKeys(styling: 'style'|'class') {
(isClassBased ? tNode.residualClasses : tNode.residualStyles) as null | string[]);
return expect(tStylingKeys);
-}
\ No newline at end of file
+}
diff --git a/packages/core/test/render3/instructions_spec.ts b/packages/core/test/render3/instructions_spec.ts
index 3f90a06cda..95074c5b76 100644
--- a/packages/core/test/render3/instructions_spec.ts
+++ b/packages/core/test/render3/instructions_spec.ts
@@ -163,7 +163,7 @@ describe('instructions', () => {
});
describe('styleProp', () => {
- it('should automatically sanitize unless a bypass operation is applied', () => {
+ it('should allow values even if a bypass operation is applied', () => {
let backgroundImage: string|SafeValue = 'url("http://server")';
const t = new TemplateFixture(
() => {
@@ -176,7 +176,7 @@ describe('instructions', () => {
2, 2);
// nothing is set because sanitizer suppresses it.
expect((t.hostElement.firstChild as HTMLElement).style.getPropertyValue('background-image'))
- .toEqual('');
+ .toEqual('url("http://server")');
backgroundImage = bypassSanitizationTrustStyle('url("http://server2")');
t.update();
diff --git a/packages/core/test/sanitization/sanitization_spec.ts b/packages/core/test/sanitization/sanitization_spec.ts
index d9dcc1bae1..106b4e34e2 100644
--- a/packages/core/test/sanitization/sanitization_spec.ts
+++ b/packages/core/test/sanitization/sanitization_spec.ts
@@ -64,8 +64,8 @@ describe('sanitization', () => {
it('should sanitize style', () => {
expect(ɵɵsanitizeStyle('red')).toEqual('red');
expect(ɵɵsanitizeStyle(new Wrap('red'))).toEqual('red');
- expect(ɵɵsanitizeStyle('url("http://server")')).toEqual('unsafe');
- expect(ɵɵsanitizeStyle(new Wrap('url("http://server")'))).toEqual('unsafe');
+ expect(ɵɵsanitizeStyle('url("http://server")')).toEqual('url("http://server")');
+ expect(ɵɵsanitizeStyle(new Wrap('url("http://server")'))).toEqual('url("http://server")');
expect(() => ɵɵsanitizeStyle(bypassSanitizationTrustHtml('url("http://server")')))
.toThrowError(/Required a safe Style, got a HTML/);
expect(ɵɵsanitizeStyle(bypassSanitizationTrustStyle('url("http://server")')))
diff --git a/packages/core/test/sanitization/style_sanitizer_spec.ts b/packages/core/test/sanitization/style_sanitizer_spec.ts
deleted file mode 100644
index 0a776483f9..0000000000
--- a/packages/core/test/sanitization/style_sanitizer_spec.ts
+++ /dev/null
@@ -1,82 +0,0 @@
-/**
- * @license
- * Copyright Google Inc. All Rights Reserved.
- *
- * Use of this source code is governed by an MIT-style license that can be
- * found in the LICENSE file at https://angular.io/license
- */
-
-import {_sanitizeStyle} from '../../src/sanitization/style_sanitizer';
-
-
-describe('Style sanitizer', () => {
- let logMsgs: string[];
- let originalLog: (msg: any) => any;
-
- beforeEach(() => {
- logMsgs = [];
- originalLog = console.warn; // Monkey patch DOM.log.
- console.warn = (msg: any) => logMsgs.push(msg);
- });
-
- afterEach(() => {
- console.warn = originalLog;
- });
-
- function expectSanitize(v: string) {
- return expect(_sanitizeStyle(v));
- }
-
- it('sanitizes values', () => {
- expectSanitize('').toEqual('');
- expectSanitize('abc').toEqual('abc');
- expectSanitize('50px').toEqual('50px');
- expectSanitize('rgb(255, 0, 0)').toEqual('rgb(255, 0, 0)');
- expectSanitize('expression(haha)').toEqual('unsafe');
- });
-
- it('rejects unblanaced quotes', () => {
- expectSanitize('"value" "').toEqual('unsafe');
- });
-
- it('accepts transform functions', () => {
- expectSanitize('rotate(90deg)').toEqual('rotate(90deg)');
- expectSanitize('rotate(javascript:evil())').toEqual('unsafe');
- expectSanitize('translateX(12px, -5px)').toEqual('translateX(12px, -5px)');
- expectSanitize('scale3d(1, 1, 2)').toEqual('scale3d(1, 1, 2)');
- });
-
- it('accepts gradients', () => {
- expectSanitize('linear-gradient(to bottom, #fg34a1, #bada55)')
- .toEqual('linear-gradient(to bottom, #fg34a1, #bada55)');
- expectSanitize('repeating-radial-gradient(ellipse cover, black, red, black, red)')
- .toEqual('repeating-radial-gradient(ellipse cover, black, red, black, red)');
- });
-
- it('accepts attr', () => {
- expectSanitize('attr(value string)').toEqual('attr(value string)');
- });
-
- it('accepts calc', () => {
- expectSanitize('calc(90%-123px)').toEqual('calc(90%-123px)');
- });
-
- it('accepts var', () => {
- expectSanitize('var(--my-custom-var)').toEqual('var(--my-custom-var)');
- });
-
- it('sanitizes URLs', () => {
- expectSanitize('url(foo/bar.png)').toEqual('url(foo/bar.png)');
- expectSanitize('url( foo/bar.png\n )').toEqual('url( foo/bar.png\n )');
- expectSanitize('url(javascript:evil())').toEqual('unsafe');
- expectSanitize('url(strangeprotocol:evil)').toEqual('unsafe');
- });
-
- it('accepts quoted URLs', () => {
- expectSanitize('url("foo/bar.png")').toEqual('url("foo/bar.png")');
- expectSanitize(`url('foo/bar.png')`).toEqual(`url('foo/bar.png')`);
- expectSanitize(`url( 'foo/bar.png'\n )`).toEqual(`url( 'foo/bar.png'\n )`);
- expectSanitize('url("javascript:evil()")').toEqual('unsafe');
- expectSanitize('url( " javascript:evil() " )').toEqual('unsafe');
- });
-});
diff --git a/packages/platform-browser/src/security/dom_sanitization_service.ts b/packages/platform-browser/src/security/dom_sanitization_service.ts
index 4bb39ff56e..997d5b2e4f 100644
--- a/packages/platform-browser/src/security/dom_sanitization_service.ts
+++ b/packages/platform-browser/src/security/dom_sanitization_service.ts
@@ -7,7 +7,7 @@
*/
import {DOCUMENT} from '@angular/common';
-import {forwardRef, Inject, Injectable, Injector, Sanitizer, SecurityContext, ɵ_sanitizeHtml as _sanitizeHtml, ɵ_sanitizeStyle as _sanitizeStyle, ɵ_sanitizeUrl as _sanitizeUrl, ɵallowSanitizationBypassAndThrow as allowSanitizationBypassOrThrow, ɵbypassSanitizationTrustHtml as bypassSanitizationTrustHtml, ɵbypassSanitizationTrustResourceUrl as bypassSanitizationTrustResourceUrl, ɵbypassSanitizationTrustScript as bypassSanitizationTrustScript, ɵbypassSanitizationTrustStyle as bypassSanitizationTrustStyle, ɵbypassSanitizationTrustUrl as bypassSanitizationTrustUrl, ɵBypassType as BypassType, ɵgetSanitizationBypassType as getSanitizationBypassType, ɵunwrapSafeValue as unwrapSafeValue} from '@angular/core';
+import {forwardRef, Inject, Injectable, Injector, Sanitizer, SecurityContext, ɵ_sanitizeHtml as _sanitizeHtml, ɵ_sanitizeUrl as _sanitizeUrl, ɵallowSanitizationBypassAndThrow as allowSanitizationBypassOrThrow, ɵbypassSanitizationTrustHtml as bypassSanitizationTrustHtml, ɵbypassSanitizationTrustResourceUrl as bypassSanitizationTrustResourceUrl, ɵbypassSanitizationTrustScript as bypassSanitizationTrustScript, ɵbypassSanitizationTrustStyle as bypassSanitizationTrustStyle, ɵbypassSanitizationTrustUrl as bypassSanitizationTrustUrl, ɵBypassType as BypassType, ɵgetSanitizationBypassType as getSanitizationBypassType, ɵunwrapSafeValue as unwrapSafeValue} from '@angular/core';
export {SecurityContext};
@@ -167,7 +167,7 @@ export class DomSanitizerImpl extends DomSanitizer {
if (allowSanitizationBypassOrThrow(value, BypassType.Style)) {
return unwrapSafeValue(value);
}
- return _sanitizeStyle(value as string);
+ return value as string;
case SecurityContext.SCRIPT:
if (allowSanitizationBypassOrThrow(value, BypassType.Script)) {
return unwrapSafeValue(value);