fix(urlUtils): made removal of windows drive from path safer

Prior to this fix, the urlResolve method would automatically
strip the first segment of a path if the segment ends in a colon.
This was to correct undesired behavior in the $location service
using the file protocol on windows in multiple browsers (see #4680).

However, there could be cases where users intentionally 
have first path segments that end in a colon 
(although this conflicts with section 3.3 of rfc3986).

The solution to this problem is an extra check to make sure
the first path segment of the input url does not end with a colon,
to make sure we're only removing undesired path segments.

Fixes #4939

1 files changed, 22 insertions, 10 deletions

diff --git a/src/ng/urlUtils.js b/src/ng/urlUtils.js
index 51d40f9e..cba8981c 100644
--- a/src/ng/urlUtils.js
+++ b/src/ng/urlUtils.js
@@ -67,7 +67,7 @@ var originUrl = urlResolve(window.location.href, true);
  *   | pathname      | The pathname, beginning with "/"
  *
  */
-function urlResolve(url) {
+function urlResolve(url, base) {
   var href = url,
       pathname;
 
@@ -92,10 +92,9 @@ function urlResolve(url) {
    * do not include drive names for routing.
    */
 
-  pathname = removeWindowsDriveName(urlParsingNode.pathname);
+  pathname = removeWindowsDriveName(urlParsingNode.pathname, url, base);
   pathname = (pathname.charAt(0) === '/') ? pathname : '/' + pathname;
 
-
   // urlParsingNode provides the UrlUtils interface - http://url.spec.whatwg.org/#urlutils
   return {
     href: urlParsingNode.href,
@@ -107,13 +106,6 @@ function urlResolve(url) {
     port: urlParsingNode.port,
     pathname: pathname
   };
-
-  function removeWindowsDriveName (path) {
-    var firstPathSegmentMatch;
-
-    firstPathSegmentMatch = windowsFilePathExp.exec(path);
-    return firstPathSegmentMatch ? firstPathSegmentMatch[1] : path;
-  }
 }
 
 
@@ -129,3 +121,23 @@ function urlIsSameOrigin(requestUrl) {
   return (parsed.protocol === originUrl.protocol &&
           parsed.host === originUrl.host);
 }
+
+function removeWindowsDriveName (path, url, base) {
+  var firstPathSegmentMatch;
+
+  //Get the relative path from the input URL.
+  if (url.indexOf(base) === 0) {
+    url = url.replace(base, '');
+  }
+
+  /*
+   * The input URL intentionally contains a
+   * first path segment that ends with a colon.
+   */
+  if (windowsFilePathExp.exec(url)) {
+    return path;
+  }
+
+  firstPathSegmentMatch = windowsFilePathExp.exec(path);
+  return firstPathSegmentMatch ? firstPathSegmentMatch[1] : path;
+}
\ No newline at end of file