iSharkFly-Docs
/
angular-docs-cn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

test(security): Ensure xlink:href is not bindable. 

The DOM schema does not allow binding any properties to dangerous SVG
attributes/properties. This change adds a smoke test to verify that
behaviour, by testing that `xlink:href` (a sample dangerous property)
is not bindable.

Fixes #9510.
This commit is contained in:
Martin Probst 2016-06-22 18:14:50 -07:00
parent 5150344213
commit 5ab0534164
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
modules/@angular/core/test/linker/security_integration_spec.ts
View File

@ -194,6 +194,19 @@ function declareTests({useJit}: {useJit: boolean}) {
});
});
itAsync(
'should escape unsafe SVG attributes',
(tcb: TestComponentBuilder, async: AsyncTestCompleter) => {
let tpl = `<svg:circle [xlink:href]="ctxProp">Text</svg:circle>`;
tcb = tcb.overrideView(
SecuredComponent, new ViewMetadata({template: tpl, directives: []}));
PromiseWrapper.catchError(tcb.createAsync(SecuredComponent), (e) => {
expect(e.message).toContain(`Can't bind to 'xlink:href'`);
async.done();
return null;
});
});
itAsync(
'should escape unsafe HTML values',
(tcb: TestComponentBuilder, async: AsyncTestCompleter) => {