@@ -700,13 +700,13 @@ describe('parser', function() {
700
700
scope . fn = Function . prototype . call ;
701
701
702
702
expect ( function ( ) {
703
- scope . $eval ( '$eval.call()' )
703
+ scope . $eval ( '$eval.call()' ) ;
704
704
} ) . toThrowMinErr (
705
705
'$parse' , 'isecff' , 'Referencing call, apply or bind in Angular expressions is disallowed! ' +
706
706
'Expression: $eval.call()' ) ;
707
707
708
708
expect ( function ( ) {
709
- scope . $eval ( 'fn()' )
709
+ scope . $eval ( 'fn()' ) ;
710
710
} ) . toThrowMinErr (
711
711
'$parse' , 'isecff' , 'Referencing call, apply or bind in Angular expressions is disallowed! ' +
712
712
'Expression: fn()' ) ;
@@ -716,13 +716,13 @@ describe('parser', function() {
716
716
scope . apply = Function . prototype . apply ;
717
717
718
718
expect ( function ( ) {
719
- scope . $eval ( '$eval.apply()' )
719
+ scope . $eval ( '$eval.apply()' ) ;
720
720
} ) . toThrowMinErr (
721
721
'$parse' , 'isecff' , 'Referencing call, apply or bind in Angular expressions is disallowed! ' +
722
722
'Expression: $eval.apply()' ) ;
723
723
724
724
expect ( function ( ) {
725
- scope . $eval ( 'apply()' )
725
+ scope . $eval ( 'apply()' ) ;
726
726
} ) . toThrowMinErr (
727
727
'$parse' , 'isecff' , 'Referencing call, apply or bind in Angular expressions is disallowed! ' +
728
728
'Expression: apply()' ) ;
@@ -732,13 +732,13 @@ describe('parser', function() {
732
732
scope . bind = Function . prototype . bind ;
733
733
734
734
expect ( function ( ) {
735
- scope . $eval ( '$eval.bind()' )
735
+ scope . $eval ( '$eval.bind()' ) ;
736
736
} ) . toThrowMinErr (
737
737
'$parse' , 'isecff' , 'Referencing call, apply or bind in Angular expressions is disallowed! ' +
738
738
'Expression: $eval.bind()' ) ;
739
739
740
740
expect ( function ( ) {
741
- scope . $eval ( 'bind()' )
741
+ scope . $eval ( 'bind()' ) ;
742
742
} ) . toThrowMinErr (
743
743
'$parse' , 'isecff' , 'Referencing call, apply or bind in Angular expressions is disallowed! ' +
744
744
'Expression: bind()' ) ;
@@ -836,98 +836,128 @@ describe('parser', function() {
836
836
837
837
describe ( 'Disallowed fields' , function ( ) {
838
838
it ( 'should NOT allow access or invocation of __defineGetter__' , function ( ) {
839
- expect ( function ( ) {
840
- scope . $eval ( '{}.__defineGetter__' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
841
- expect ( function ( ) {
842
- scope . $eval ( '{}.__defineGetter__("a", "".charAt)' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
839
+ expect ( function ( ) {
840
+ scope . $eval ( '{}.__defineGetter__' ) ;
841
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
842
+ expect ( function ( ) {
843
+ scope . $eval ( '{}.__defineGetter__("a", "".charAt)' ) ;
844
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
843
845
844
- expect ( function ( ) {
845
- scope . $eval ( '{}["__defineGetter__"]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
846
- expect ( function ( ) {
847
- scope . $eval ( '{}["__defineGetter__"]("a", "".charAt)' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
846
+ expect ( function ( ) {
847
+ scope . $eval ( '{}["__defineGetter__"]' ) ;
848
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
849
+ expect ( function ( ) {
850
+ scope . $eval ( '{}["__defineGetter__"]("a", "".charAt)' ) ;
851
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
848
852
849
853
scope . a = "__define" ;
850
854
scope . b = "Getter__" ;
851
- expect ( function ( ) {
852
- scope . $eval ( '{}[a + b]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
853
- expect ( function ( ) {
854
- scope . $eval ( '{}[a + b]("a", "".charAt)' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
855
+ expect ( function ( ) {
856
+ scope . $eval ( '{}[a + b]' ) ;
857
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
858
+ expect ( function ( ) {
859
+ scope . $eval ( '{}[a + b]("a", "".charAt)' ) ;
860
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
855
861
} ) ;
856
862
857
863
it ( 'should NOT allow access or invocation of __defineSetter__' , function ( ) {
858
864
expect ( function ( ) {
859
- scope . $eval ( '{}.__defineSetter__' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
865
+ scope . $eval ( '{}.__defineSetter__' ) ;
866
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
860
867
expect ( function ( ) {
861
- scope . $eval ( '{}.__defineSetter__("a", "".charAt)' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
868
+ scope . $eval ( '{}.__defineSetter__("a", "".charAt)' ) ;
869
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
862
870
863
871
expect ( function ( ) {
864
- scope . $eval ( '{}["__defineSetter__"]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
872
+ scope . $eval ( '{}["__defineSetter__"]' ) ;
873
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
865
874
expect ( function ( ) {
866
- scope . $eval ( '{}["__defineSetter__"]("a", "".charAt)' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
875
+ scope . $eval ( '{}["__defineSetter__"]("a", "".charAt)' ) ;
876
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
867
877
868
878
scope . a = "__define" ;
869
879
scope . b = "Setter__" ;
870
880
expect ( function ( ) {
871
- scope . $eval ( '{}[a + b]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
881
+ scope . $eval ( '{}[a + b]' ) ;
882
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
872
883
expect ( function ( ) {
873
- scope . $eval ( '{}[a + b]("a", "".charAt)' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
884
+ scope . $eval ( '{}[a + b]("a", "".charAt)' ) ;
885
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
874
886
} ) ;
875
887
876
888
it ( 'should NOT allow access or invocation of __lookupGetter__' , function ( ) {
877
889
expect ( function ( ) {
878
- scope . $eval ( '{}.__lookupGetter__' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
890
+ scope . $eval ( '{}.__lookupGetter__' ) ;
891
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
879
892
expect ( function ( ) {
880
- scope . $eval ( '{}.__lookupGetter__("a")' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
893
+ scope . $eval ( '{}.__lookupGetter__("a")' ) ;
894
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
881
895
882
896
expect ( function ( ) {
883
- scope . $eval ( '{}["__lookupGetter__"]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
897
+ scope . $eval ( '{}["__lookupGetter__"]' ) ;
898
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
884
899
expect ( function ( ) {
885
- scope . $eval ( '{}["__lookupGetter__"]("a")' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
900
+ scope . $eval ( '{}["__lookupGetter__"]("a")' ) ;
901
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
886
902
887
903
scope . a = "__lookup" ;
888
904
scope . b = "Getter__" ;
889
905
expect ( function ( ) {
890
- scope . $eval ( '{}[a + b]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
906
+ scope . $eval ( '{}[a + b]' ) ;
907
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
891
908
expect ( function ( ) {
892
- scope . $eval ( '{}[a + b]("a")' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
909
+ scope . $eval ( '{}[a + b]("a")' ) ;
910
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
893
911
} ) ;
894
912
895
913
it ( 'should NOT allow access or invocation of __lookupSetter__' , function ( ) {
896
914
expect ( function ( ) {
897
- scope . $eval ( '{}.__lookupSetter__' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
915
+ scope . $eval ( '{}.__lookupSetter__' ) ;
916
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
898
917
expect ( function ( ) {
899
- scope . $eval ( '{}.__lookupSetter__("a")' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
918
+ scope . $eval ( '{}.__lookupSetter__("a")' ) ;
919
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
900
920
901
921
expect ( function ( ) {
902
- scope . $eval ( '{}["__lookupSetter__"]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
922
+ scope . $eval ( '{}["__lookupSetter__"]' ) ;
923
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
903
924
expect ( function ( ) {
904
- scope . $eval ( '{}["__lookupSetter__"]("a")' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
925
+ scope . $eval ( '{}["__lookupSetter__"]("a")' ) ;
926
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
905
927
906
928
scope . a = "__lookup" ;
907
929
scope . b = "Setter__" ;
908
930
expect ( function ( ) {
909
- scope . $eval ( '{}[a + b]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
931
+ scope . $eval ( '{}[a + b]' ) ;
932
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
910
933
expect ( function ( ) {
911
- scope . $eval ( '{}[a + b]("a")' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
934
+ scope . $eval ( '{}[a + b]("a")' ) ;
935
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
912
936
} ) ;
913
937
914
938
it ( 'should NOT allow access to __proto__' , function ( ) {
915
939
expect ( function ( ) {
916
- scope . $eval ( '{}.__proto__' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
940
+ scope . $eval ( '{}.__proto__' ) ;
941
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
917
942
expect ( function ( ) {
918
- scope . $eval ( '{}.__proto__.foo = 1' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
943
+ scope . $eval ( '{}.__proto__.foo = 1' ) ;
944
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
919
945
920
946
expect ( function ( ) {
921
- scope . $eval ( '{}["__proto__"]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
947
+ scope . $eval ( '{}["__proto__"]' ) ;
948
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
922
949
expect ( function ( ) {
923
- scope . $eval ( '{}["__proto__"].foo = 1' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
950
+ scope . $eval ( '{}["__proto__"].foo = 1' ) ;
951
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
924
952
925
953
scope . a = "__pro" ;
926
954
scope . b = "to__" ;
927
955
expect ( function ( ) {
928
- scope . $eval ( '{}[a + b]' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
956
+ scope . $eval ( '{}[a + b]' ) ;
957
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
929
958
expect ( function ( ) {
930
- scope . $eval ( '{}[a + b].foo = 1' ) ; } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
959
+ scope . $eval ( '{}[a + b].foo = 1' ) ;
960
+ } ) . toThrowMinErr ( '$parse' , 'isecfld' ) ;
931
961
} ) ;
932
962
} ) ;
933
963
@@ -939,9 +969,9 @@ describe('parser', function() {
939
969
'null,' +
940
970
'"alert(1)"' +
941
971
')()' +
942
- '' )
972
+ '' ) ;
943
973
} ) . toThrow ( ) ;
944
- } )
974
+ } ) ;
945
975
} ) ;
946
976
947
977
it ( 'should call the function from the received instance and not from a new one' , function ( ) {
0 commit comments