fix(sanitizeUri): sanitize URIs that contain IDEOGRAPHIC SPACE chars

petebacondarwin · petebacondarwin · commit bf1f5d09ab2b · 2017-10-31T21:41:28.000Z
Chrome 62 was not sanitizing dangerous URLs containing JavaScript, if they started with these "whitespace" characters. Closes #16288
diff --git a/src/ng/sanitizeUri.js b/src/ng/sanitizeUri.js
@@ -62,7 +62,7 @@ function $$SanitizeUriProvider() {
     return function sanitizeUri(uri, isImage) {
       var regex = isImage ? imgSrcSanitizationWhitelist : aHrefSanitizationWhitelist;
       var normalizedVal;
-      normalizedVal = urlResolve(uri).href;
+      normalizedVal = urlResolve(uri && uri.trim()).href;
       if (normalizedVal !== '' && !normalizedVal.match(regex)) {
         return 'unsafe:' + normalizedVal;
       }

Original file line number	Diff line number	Diff line change
`@@ -62,7 +62,7 @@ function $$SanitizeUriProvider() {`
`62`	`62`	`return function sanitizeUri(uri, isImage) {`
`63`	`63`	`var regex = isImage ? imgSrcSanitizationWhitelist : aHrefSanitizationWhitelist;`
`64`	`64`	`var normalizedVal;`
`65`		`- normalizedVal = urlResolve(uri).href;`
	`65`	`+ normalizedVal = urlResolve(uri && uri.trim()).href;`
`66`	`66`	`if (normalizedVal !== '' && !normalizedVal.match(regex)) {`
`67`	`67`	`return 'unsafe:' + normalizedVal;`
`68`	`68`	`}`