c').toEqual('a
c'); + expectHTML('a
c').toEqual('a
c'); }); it('should handle namespace', function() { @@ -194,32 +163,33 @@ describe('HTML', function() { it('should handle entities', function() { var everything = '
' +
- '!@#$%^&*()_+-={}[]:";\'<>?,./`~ ħ
';
+ '!@#$%^&*()_+-={}[]:";\'<>?,./`~ ħ';
expectHTML(everything).toEqual(everything);
});
it('should mangle improper html', function() {
// This text is encoded more than a real HTML parser would, but it should render the same.
expectHTML('< div rel="" alt=abc dir=\'"\' >text< /div>').
- toBe('< div rel="" alt=abc dir=\'"\' >text< /div>');
+ toBe('< div rel="" alt=abc dir=\'"\' >text< /div>');
});
it('should mangle improper html2', function() {
// A proper HTML parser would clobber this more in most cases, but it looks reasonable.
expectHTML('< div rel="" / >').
- toBe('< div rel="" / >');
+ toBe('< div rel="" / >');
});
it('should ignore back slash as escape', function() {
expectHTML('10 < 100
') - .toEqual('10 < 100
'); + .toEqual('10 < 100
'); }); it('should accept non-string arguments', function() { @@ -246,27 +216,83 @@ describe('HTML', function() { expectHTML(false).toBe('false'); }); - it('should accept SVG tags', function() { - expectHTML('') - .toEqual(''); + + it('should strip svg elements if not enabled via provider', function() { + expectHTML('') + .toEqual(''); }); - it('should sanitize SVG xlink:href attribute values', function() { - expectHTML('') - .toEqual(''); + it('should prevent mXSS attacks', function() { + expectHTML('CLICKME').toBe('CLICKME'); + }); - expectHTML('') - .toEqual(''); + it('should strip html comments', function() { + expectHTML('text1text2
') + .toEqual('text1text2
'); }); - it('should sanitize unknown namespaced SVG attributes', function() { - expectHTML('') - .toEqual(''); - expectHTML('') - .toEqual(''); + describe('SVG support', function() { + + beforeEach(module(function($sanitizeProvider) { + $sanitizeProvider.enableSvg(true); + })); + + + it('should accept SVG tags', function() { + expectHTML('') + .toBeOneOf('', + '', + ''); + }); + + it('should not ignore white-listed svg camelCased attributes', function() { + expectHTML('') + .toBeOneOf('', + ''); + }); + + it('should sanitize SVG xlink:href attribute values', function() { + expectHTML('') + .toBeOneOf('', + '', + ''); + + expectHTML('') + .toBeOneOf('', + '', + '', + ''); + }); + + it('should sanitize unknown namespaced SVG attributes', function() { + expectHTML('') + .toBeOneOf('', + '', + ''); + + expectHTML('') + .toBeOneOf('', + '', + ''); + }); + + + it('should not accept SVG animation tags', function() { + expectHTML('') + .toBeOneOf('', + ''); + + expectHTML('') + .toBeOneOf('', + '', + '', + ''); + }); }); + describe('htmlSanitizerWriter', function() { /* global htmlSanitizeWriter: false */ if (angular.isUndefined(window.htmlSanitizeWriter)) return; @@ -420,11 +446,11 @@ describe('HTML', function() { inject(function() { $$sanitizeUri.andReturn('someUri'); - expectHTML('