diff options
| author | Vojta Jina | 2013-11-13 23:25:09 -0800 |
|---|---|---|
| committer | Vojta Jina | 2013-11-13 23:25:09 -0800 |
| commit | 4ab16aaaf762e9038803da1f967ac8cb6650727d (patch) | |
| tree | db90bd8b9e322a31b4c2722d5f96e20e0519a0ef /test/ng/parseSpec.js | |
| parent | 89f435de847635e3ec339726e6f83cf3f0ee9091 (diff) | |
| download | angular.js-4ab16aaaf762e9038803da1f967ac8cb6650727d.tar.bz2 | |
feat($parse): revert hiding "private" properties
Hiding `_*` properties was a feature primarily for developers using Closure compiler and Google JS
style. We didn't realize how many people will be affected by this change.
We might introduce this feature in the future, probably under a config option, but it needs more
research and so I'm reverting the change for now.
This reverts commit 3d6a89e8888b14ae5cb5640464e12b7811853c7e.
Closes #4926
Closes #4842
Closes #4865
Closes #4859
Closes #4849
Conflicts:
src/ng/parse.js
Diffstat (limited to 'test/ng/parseSpec.js')
| -rw-r--r-- | test/ng/parseSpec.js | 67 |
1 files changed, 2 insertions, 65 deletions
diff --git a/test/ng/parseSpec.js b/test/ng/parseSpec.js index c72b7e81..d7d0d941 100644 --- a/test/ng/parseSpec.js +++ b/test/ng/parseSpec.js @@ -591,57 +591,6 @@ describe('parser', function() { }); describe('sandboxing', function() { - describe('private members', function() { - it('should NOT allow access to private members', function() { - forEach(['_name', 'name_', '_', '_name_'], function(name) { - function _testExpression(expression) { - scope.a = {b: name}; - scope[name] = {a: scope.a}; - scope.piece_1 = "XX" + name.charAt(0) + "XX"; - scope.piece_2 = "XX" + name.substr(1) + "XX"; - expect(function() { - scope.$eval(expression); - }).toThrowMinErr( - '$parse', 'isecprv', 'Referencing private fields in Angular expressions is disallowed! ' + - 'Expression: ' + expression); - } - - function testExpression(expression) { - if (expression.indexOf('"NAME"') != -1) { - var concatExpr = 'piece_1.substr(2, 1) + piece_2.substr(2, LEN)'.replace('LEN', name.length-1); - _testExpression(expression.replace(/"NAME"/g, concatExpr)); - _testExpression(expression.replace(/"NAME"/g, '(' + concatExpr + ')')); - } - _testExpression(expression.replace(/NAME/g, name)); - } - - // Not all of these are exploitable. The tests ensure that the contract is honored - // without caring about the implementation or exploitability. - testExpression('NAME'); testExpression('NAME = 1'); - testExpression('(NAME)'); testExpression('(NAME) = 1'); - testExpression('a.NAME'); testExpression('a.NAME = 1'); - testExpression('NAME.b'); testExpression('NAME.b = 1'); - testExpression('a.NAME.b'); testExpression('a.NAME.b = 1'); - testExpression('NAME()'); testExpression('NAME() = 1'); - testExpression('(NAME)()'); testExpression('(NAME = 1)()'); - testExpression('(NAME).foo()'); testExpression('(NAME = 1).foo()'); - testExpression('a.NAME()'); testExpression('a.NAME() = 1'); - testExpression('a.NAME.foo()'); testExpression('a.NAME.foo()'); - testExpression('foo(NAME)'); testExpression('foo(NAME = 1)'); - testExpression('foo(a.NAME)'); testExpression('foo(a.NAME = 1)'); - testExpression('foo(1, a.NAME)'); testExpression('foo(1, a.NAME = 1)'); - testExpression('foo(a["NAME"])'); testExpression('foo(a["NAME"] = 1)'); - testExpression('foo(1, a["NAME"])'); testExpression('foo(1, a["NAME"] = 1)'); - testExpression('foo(b = a["NAME"])'); testExpression('foo(b = (a["NAME"] = 1))'); - testExpression('a["NAME"]'); testExpression('a["NAME"] = 1'); - testExpression('a["NAME"]()'); - testExpression('a["NAME"].foo()'); - testExpression('a.b["NAME"]'); testExpression('a.b["NAME"] = 1'); - testExpression('a["b"]["NAME"]'); testExpression('a["b"]["NAME"] = 1'); - }); - }); - }); - describe('Function constructor', function() { it('should NOT allow access to Function constructor in getter', function() { expect(function() { @@ -702,29 +651,17 @@ describe('parser', function() { expect(function() { scope.$eval('{}.toString["constructor"]["constructor"] = 1'); }).toThrowMinErr( - '$parse', 'isecfld', 'Referencing "constructor" field in Angular expressions is disallowed! ' + + '$parse', 'isecfn', 'Referencing Function in Angular expressions is disallowed! ' + 'Expression: {}.toString["constructor"]["constructor"] = 1'); scope.key1 = "const"; scope.key2 = "ructor"; expect(function() { - scope.$eval('{}.toString[key1 + key2].foo'); - }).toThrowMinErr( - '$parse', 'isecfn', 'Referencing Function in Angular expressions is disallowed! ' + - 'Expression: {}.toString[key1 + key2].foo'); - - expect(function() { - scope.$eval('{}.toString[key1 + key2] = 1'); - }).toThrowMinErr( - '$parse', 'isecfld', 'Referencing "constructor" field in Angular expressions is disallowed! ' + - 'Expression: {}.toString[key1 + key2] = 1'); - - expect(function() { scope.$eval('{}.toString[key1 + key2].foo = 1'); }).toThrowMinErr( '$parse', 'isecfn', 'Referencing Function in Angular expressions is disallowed! ' + - 'Expression: {}.toString[key1 + key2].foo = 1'); + 'Expression: {}.toString[key1 + key2].foo = 1'); expect(function() { scope.$eval('{}.toString["constructor"]["a"] = 1'); |
