fix($sanitize): sanitize javascript urls with comments

btford · btford · commit 4f3870500da6 · 2014-08-19T14:16:01.000-07:00
Closes angular#8274
diff --git a/src/ng/sanitizeUri.js b/src/ng/sanitizeUri.js
@@ -6,7 +6,7 @@
  */
 function $$SanitizeUriProvider() {
   var aHrefSanitizationWhitelist = /^\s*(https?|ftp|mailto|tel|file):/,
-    imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file):|data:image\//;
+    imgSrcSanitizationWhitelist = /^\s*((https?|ftp|file):|data:image\/)/;
 
   /**
    * @description
diff --git a/test/ng/sanitizeUriSpec.js b/test/ng/sanitizeUriSpec.js
@@ -30,6 +30,11 @@ describe('sanitizeUri', function() {
       expect(sanitizeImg(testUrl)).toBe('unsafe:javascript:doEvilStuff()');
     });
 
+    it('should sanitize javascript: urls with comments', function() {
+      testUrl = "javascript:alert(1)//data:image/";
+      expect(sanitizeImg(testUrl)).toBe('unsafe:javascript:alert(1)//data:image/');
+    });
+
     it('should sanitize non-image data: urls', function() {
       testUrl = "data:application/javascript;charset=US-ASCII,alert('evil!');";
       expect(sanitizeImg(testUrl)).toBe("unsafe:data:application/javascript;charset=US-ASCII,alert('evil!');");
@@ -235,4 +240,4 @@ describe('sanitizeUri', function() {
 
   });
 
-});
+});
