cargdev/angular
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): support transform CSS functions for sanitization.

Browse Source 
Fixes part of #8514.
This commit is contained in:
Martin Probst
2016-05-09 09:57:07 +02:00
parent 9a05ca95f6
commit 8b1b427195
2 changed files with 27 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
modules/@angular/platform-browser/test/security/style_sanitizer_spec.ts
View File

@ -15,14 +15,20 @@ export function main() {
});
t.afterEach(() => { getDOM().log = originalLog; });
function expectSanitize(v: string) { return t.expect(sanitizeStyle(v)); }
t.it('sanitizes values', () => {
t.expect(sanitizeStyle('abc')).toEqual('abc');
t.expect(sanitizeStyle('expression(haha)')).toEqual('unsafe');
// Unbalanced quotes.
t.expect(sanitizeStyle('"value" "')).toEqual('unsafe');
t.expect(logMsgs.join('\n')).toMatch(/sanitizing unsafe style value/);
expectSanitize('abc').toEqual('abc');
expectSanitize('50px').toEqual('50px');
expectSanitize('rgb(255, 0, 0)').toEqual('rgb(255, 0, 0)');
expectSanitize('expression(haha)').toEqual('unsafe');
});
t.it('rejects unblanaced quotes', () => { expectSanitize('"value" "').toEqual('unsafe'); });
t.it('accepts transform functions', () => {
expectSanitize('rotate(90deg)').toEqual('rotate(90deg)');
expectSanitize('rotate(javascript:evil())').toEqual('unsafe');
expectSanitize('translateX(12px, -5px)').toEqual('translateX(12px, -5px)');
expectSanitize('scale3d(1, 1, 2)').toEqual('scale3d(1, 1, 2)');
});
});
}