fix(sanitize): handle newline characters inside special tags

lgalfaso · lgalfaso · commit cc8755cda6ef · 2015-02-04T15:26:44.000+01:00
Handle newlines characters when they are present inside <script> and <style> tags. Closes #10943
diff --git a/src/ngSanitize/sanitize.js b/src/ngSanitize/sanitize.js
@@ -336,7 +336,7 @@ function htmlParser(html, handler) {
       }
 
     } else {
-      html = html.replace(new RegExp("(.*)<\\s*\\/\\s*" + stack.last() + "[^>]*>", 'i'),
+      html = html.replace(new RegExp("([^]*)<\\s*\\/\\s*" + stack.last() + "[^>]*>", 'i'),
         function(all, text) {
           text = text.replace(COMMENT_REGEXP, "$1").replace(CDATA_REGEXP, "$1");
 
diff --git a/test/ngSanitize/sanitizeSpec.js b/test/ngSanitize/sanitizeSpec.js
@@ -140,6 +140,10 @@ describe('HTML', function() {
     expectHTML('a<SCRIPT>evil< / scrIpt >c.').toEqual('ac.');
   });
 
+  it('should remove script that has newline characters', function() {
+    expectHTML('a<SCRIPT\n>\n\revil\n\r< / scrIpt\n >c.').toEqual('ac.');
+  });
+
   it('should remove DOCTYPE header', function() {
     expectHTML('<!DOCTYPE html>').toEqual('');
     expectHTML('<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"\n"http://www.w3.org/TR/html4/strict.dtd">').toEqual('');
@@ -160,6 +164,10 @@ describe('HTML', function() {
     expectHTML('a<STyle>evil</stYle>c.').toEqual('ac.');
   });
 
+  it('should remove style that has newline characters', function() {
+    expectHTML('a<STyle \n>\n\revil\n\r</stYle\n>c.').toEqual('ac.');
+  });
+
   it('should remove script and style', function() {
     expectHTML('a<STyle>evil<script></script></stYle>c.').toEqual('ac.');
   });

Original file line number	Diff line number	Diff line change
`@@ -336,7 +336,7 @@ function htmlParser(html, handler) {`
`336`	`336`	`}`
`337`	`337`
`338`	`338`	`} else {`
`339`		`- html = html.replace(new RegExp("(.)<\\s\\/\\s" + stack.last() + "[^>]>", 'i'),`
	`339`	`+ html = html.replace(new RegExp("([^])<\\s\\/\\s" + stack.last() + "[^>]>", 'i'),`
`340`	`340`	`function(all, text) {`
`341`	`341`	`text = text.replace(COMMENT_REGEXP, "$1").replace(CDATA_REGEXP, "$1");`
`342`	`342`