feat(): whitelist blob urls for sanitization of data-bound image urls

Closes angular#4623
mkuehn · Mar 10, 2014 · 47ab8df · 47ab8df
1 parent b700282
commit 47ab8df
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 9 deletions.
diff --git a/src/ng/sanitizeUri.js b/src/ng/sanitizeUri.js
@@ -6,7 6,7 @@
  */
 function $$SanitizeUriProvider() {
  var aHrefSanitizationWhitelist = /^\s*(https?|ftp|mailto|tel|file):/,
- imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file):|data:image\//;
  imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file|blob):|data:image\//;
 
  /**
  * @description

diff --git a/test/ng/sanitizeUriSpec.js b/test/ng/sanitizeUriSpec.js
@@ -37,13 37,6 @@ describe('sanitizeUri', function() {
  expect(sanitizeImg(testUrl)).toBe("unsafe:data:,foo");
  });
 
- it('should not sanitize data: URIs for images', function() {
- // image data uri
- // ref: http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever
- testUrl = "data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==";
- expect(sanitizeImg(testUrl)).toBe('data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==');
- });
-
  it('should sanitize mailto: urls', function() {
  testUrl = "mailto:[email protected]";
  expect(sanitizeImg(testUrl)).toBe('unsafe:mailto:[email protected]');
@@ -113,6 106,17 @@ describe('sanitizeUri', function() {
  expect(sanitizeImg(testUrl)).toBe('file:///foo/bar.html');
  });
 
  it('should not sanitize blob urls', function() {
  testUrl = "blob:///foo/bar.html";
  expect(sanitizeImg(testUrl)).toBe('blob:///foo/bar.html');
  });
 
  it('should not sanitize data: URIs for images', function() {
  // image data uri
  // ref: http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever
  testUrl = "data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==";
  expect(sanitizeImg(testUrl)).toBe('data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==');
  });
 
  it('should allow reconfiguration of the src whitelist', function() {
  var returnVal;
@@ -227,4 231,4 @@ describe('sanitizeUri', function() {
 
  });
 
-});
 });