From 6d324c76f0d3ad7dae69ce01b14e0564938fb15e Mon Sep 17 00:00:00 2001
From: Chirayu Krishnappa
Date: Mon, 14 Oct 2013 16:05:53 -0700
Subject: fix($parse): check function call context to be safe

Closes #4417
---
 test/ng/parseSpec.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'test/ng/parseSpec.js')

diff --git a/test/ng/parseSpec.js b/test/ng/parseSpec.js
index 940bd6d6..d7d0d941 100644
--- a/test/ng/parseSpec.js
+++ b/test/ng/parseSpec.js
@@ -730,6 +730,20 @@ describe('parser', function() {
                     '$parse', 'isecdom', 'Referencing DOM nodes in Angular expressions is ' +
                     'disallowed! Expression: getDoc()');
           }));
+
+          it('should NOT allow calling functions on Window or DOM', inject(function($window, $document) {
+            scope.a = {b: { win: $window, doc: $document }};
+            expect(function() {
+              scope.$eval('a.b.win.alert(1)', scope);
+            }).toThrowMinErr(
+                    '$parse', 'isecwindow', 'Referencing the Window in Angular expressions is ' +
+                    'disallowed! Expression: a.b.win.alert(1)');
+            expect(function() {
+              scope.$eval('a.b.doc.on("click")', scope);
+            }).toThrowMinErr(
+                    '$parse', 'isecdom', 'Referencing DOM nodes in Angular expressions is ' +
+                    'disallowed! Expression: a.b.doc.on("click")');
+          }));
         });
       });
 
-- 
cgit v1.2.3