fix($templateRequest): trust empty templates in $templateCache as well

rjamet · gkalpak · commit ad21f8feaf86 · 2016-04-25T20:22:54.000+03:00
Implicitly trust empty templates added to `$templateCache` as is the case for all other templates. Fixes angular#14479 Closes angular#14496
diff --git a/src/ng/templateRequest.js b/src/ng/templateRequest.js
@@ -31,7 +31,7 @@ function $TemplateRequestProvider() {
       // are included in there. This also makes Angular accept any script
       // directive, no matter its name. However, we still need to unwrap trusted
       // types.
-      if (!isString(tpl) || !$templateCache.get(tpl)) {
+      if (!isString(tpl) || isUndefined($templateCache.get(tpl))) {
         tpl = $sce.getTrustedResourceUrl(tpl);
       }
 
diff --git a/test/ng/templateRequestSpec.js b/test/ng/templateRequestSpec.js
@@ -81,6 +81,39 @@ describe('$templateRequest', function() {
     }).not.toThrow();
   }));
 
+  it('should accept empty templates and refuse null or undefined templates in cache',
+    inject(function($rootScope, $templateRequest, $templateCache, $sce) {
+
+    // Will throw on any template not in cache.
+    spyOn($sce, 'getTrustedResourceUrl').and.returnValue(false);
+
+    expect(function() {
+      $templateRequest('tpl.html'); // should go through $sce
+      $rootScope.$digest();
+    }).toThrow();
+
+    $templateCache.put('tpl.html'); // is a no-op, so $sce check as well.
+    expect(function() {
+      $templateRequest('tpl.html');
+      $rootScope.$digest();
+    }).toThrow();
+    $templateCache.removeAll();
+
+    $templateCache.put('tpl.html', null); // makes no sense, but it's been added, so trust it.
+    expect(function() {
+      $templateRequest('tpl.html');
+      $rootScope.$digest();
+    }).not.toThrow();
+    $templateCache.removeAll();
+
+    $templateCache.put('tpl.html', ''); // should work (empty template)
+    expect(function() {
+      $templateRequest('tpl.html');
+      $rootScope.$digest();
+    }).not.toThrow();
+    $templateCache.removeAll();
+  }));
+
   it('should keep track of how many requests are going on',
     inject(function($rootScope, $templateRequest, $httpBackend) {
 

Original file line number	Diff line number	Diff line change
`@@ -31,7 +31,7 @@ function $TemplateRequestProvider() {`
`31`	`31`	`// are included in there. This also makes Angular accept any script`
`32`	`32`	`// directive, no matter its name. However, we still need to unwrap trusted`
`33`	`33`	`// types.`
`34`		`- if (!isString(tpl) \|\| !$templateCache.get(tpl)) {`
	`34`	`+ if (!isString(tpl) \|\| isUndefined($templateCache.get(tpl))) {`
`35`	`35`	`tpl = $sce.getTrustedResourceUrl(tpl);`
`36`	`36`	`}`
`37`	`37`