feat(): whitelist blob urls for sanitization of data-bound image urls

Closes #4623

1 files changed, 12 insertions, 8 deletions

diff --git a/test/ng/sanitizeUriSpec.js b/test/ng/sanitizeUriSpec.js
index b9f6a0e2..7de3f065 100644
--- a/test/ng/sanitizeUriSpec.js
+++ b/test/ng/sanitizeUriSpec.js
@@ -37,13 +37,6 @@ describe('sanitizeUri', function() {
       expect(sanitizeImg(testUrl)).toBe("unsafe:data:,foo");
     });
 
-    it('should not sanitize data: URIs for images', function() {
-      // image data uri
-      // ref: http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever
-      testUrl = "data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==";
-      expect(sanitizeImg(testUrl)).toBe('data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==');
-    });
-
     it('should sanitize mailto: urls', function() {
       testUrl = "mailto:foo@bar.com";
       expect(sanitizeImg(testUrl)).toBe('unsafe:mailto:foo@bar.com');
@@ -113,6 +106,17 @@ describe('sanitizeUri', function() {
       expect(sanitizeImg(testUrl)).toBe('file:///foo/bar.html');
     });
 
+    it('should not sanitize blob urls', function() {
+      testUrl = "blob:///foo/bar.html";
+      expect(sanitizeImg(testUrl)).toBe('blob:///foo/bar.html');
+    });
+
+    it('should not sanitize data: URIs for images', function() {
+      // image data uri
+      // ref: http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever
+      testUrl = "data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==";
+      expect(sanitizeImg(testUrl)).toBe('data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==');
+    });
 
     it('should allow reconfiguration of the src whitelist', function() {
       var returnVal;
@@ -227,4 +231,4 @@ describe('sanitizeUri', function() {
 
   });
 
-});
\ No newline at end of file
+});