fix($compile): properly sanitize xlink:href attribute interoplation

IgorMinar · gkalpak · commit f2fa1ed83d18 · 2016-07-20T19:14:51.000+03:00
Closes #12524
diff --git a/src/ng/compile.js b/src/ng/compile.js
@@ -768,7 +768,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
         nodeName = nodeName_(this.$$element);
 
         // sanitize a[href] and img[src] values
-        if ((nodeName === 'A' && key === 'href') ||
+        if ((nodeName === 'A' && (key === 'href' || key === 'xlinkHref')) ||
             (nodeName === 'IMG' && key === 'src')) {
           this[key] = value = $$sanitizeUri(value, key === 'src');
         }
diff --git a/test/ng/compileSpec.js b/test/ng/compileSpec.js
@@ -4787,6 +4787,37 @@ describe('$compile', function() {
       });
     });
 
+    it('should use $$sanitizeUri when declared via ng-href', function() {
+      var $$sanitizeUri = jasmine.createSpy('$$sanitizeUri');
+      module(function($provide) {
+        $provide.value('$$sanitizeUri', $$sanitizeUri);
+      });
+      inject(function($compile, $rootScope) {
+        element = $compile('<a ng-href="{{testUrl}}"></a>')($rootScope);
+        $rootScope.testUrl = "someUrl";
+
+        $$sanitizeUri.andReturn('someSanitizedUrl');
+        $rootScope.$apply();
+        expect(element.attr('href')).toBe('someSanitizedUrl');
+        expect($$sanitizeUri).toHaveBeenCalledWith($rootScope.testUrl, false);
+      });
+    });
+
+    it('should use $$sanitizeUri when working with svg and xlink:href', function() {
+      var $$sanitizeUri = jasmine.createSpy('$$sanitizeUri');
+      module(function($provide) {
+        $provide.value('$$sanitizeUri', $$sanitizeUri);
+      });
+      inject(function($compile, $rootScope) {
+        element = $compile('<svg><a xlink:href="" ng-href="{{ testUrl }}"></a></svg>')($rootScope);
+        $rootScope.testUrl = "evilUrl";
+
+        $$sanitizeUri.andReturn('someSanitizedUrl');
+        $rootScope.$apply();
+        expect(element.find('a').prop('href').baseVal).toBe('someSanitizedUrl');
+        expect($$sanitizeUri).toHaveBeenCalledWith($rootScope.testUrl, false);
+      });
+    });
   });
 
   describe('interpolation on HTML DOM event handler attributes onclick, onXYZ, formaction', function() {

Original file line number	Diff line number	Diff line change
`@@ -768,7 +768,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {`
`768`	`768`	`nodeName = nodeName_(this.$$element);`
`769`	`769`
`770`	`770`	`// sanitize a[href] and img[src] values`
`771`		`- if ((nodeName === 'A' && key === 'href') \|\|`
	`771`	`+ if ((nodeName === 'A' && (key === 'href' \|\| key === 'xlinkHref')) \|\|`
`772`	`772`	`(nodeName === 'IMG' && key === 'src')) {`
`773`	`773`	`this[key] = value = $$sanitizeUri(value, key === 'src');`
`774`	`774`	`}`