diff options
| -rw-r--r-- | src/ng/sanitizeUri.js | 2 | ||||
| -rw-r--r-- | test/ng/sanitizeUriSpec.js | 20 |
2 files changed, 13 insertions, 9 deletions
diff --git a/src/ng/sanitizeUri.js b/src/ng/sanitizeUri.js index 97325094..d1416839 100644 --- a/src/ng/sanitizeUri.js +++ b/src/ng/sanitizeUri.js @@ -6,7 +6,7 @@ */ function $$SanitizeUriProvider() { var aHrefSanitizationWhitelist = /^\s*(https?|ftp|mailto|tel|file):/, - imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file):|data:image\//; + imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file|blob):|data:image\//; /** * @description diff --git a/test/ng/sanitizeUriSpec.js b/test/ng/sanitizeUriSpec.js index b9f6a0e2..7de3f065 100644 --- a/test/ng/sanitizeUriSpec.js +++ b/test/ng/sanitizeUriSpec.js @@ -37,13 +37,6 @@ describe('sanitizeUri', function() { expect(sanitizeImg(testUrl)).toBe("unsafe:data:,foo"); }); - it('should not sanitize data: URIs for images', function() { - // image data uri - // ref: http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever - testUrl = "data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="; - expect(sanitizeImg(testUrl)).toBe('data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=='); - }); - it('should sanitize mailto: urls', function() { testUrl = "mailto:foo@bar.com"; expect(sanitizeImg(testUrl)).toBe('unsafe:mailto:foo@bar.com'); @@ -113,6 +106,17 @@ describe('sanitizeUri', function() { expect(sanitizeImg(testUrl)).toBe('file:///foo/bar.html'); }); + it('should not sanitize blob urls', function() { + testUrl = "blob:///foo/bar.html"; + expect(sanitizeImg(testUrl)).toBe('blob:///foo/bar.html'); + }); + + it('should not sanitize data: URIs for images', function() { + // image data uri + // ref: http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever + testUrl = "data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="; + expect(sanitizeImg(testUrl)).toBe('data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=='); + }); it('should allow reconfiguration of the src whitelist', function() { var returnVal; @@ -227,4 +231,4 @@ describe('sanitizeUri', function() { }); -});
\ No newline at end of file +}); |