Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

Broken Parser in CSP mode in 1.3.0-rc.1 #9055

Closed
gkalpak opened this issue Sep 12, 2014 · 1 comment
Closed

Broken Parser in CSP mode in 1.3.0-rc.1 #9055

gkalpak opened this issue Sep 12, 2014 · 1 comment

Comments

@gkalpak
Copy link
Member

gkalpak commented Sep 12, 2014

Just tried to use version 1.3.0-rc.1 in CSP mode and got into the following error:

Error: [ngModel:nonassign] Expression 'config.nick' is non-assignable. Element: <input type="text" name="nick" ng-model="config.nick" ng-required="true" placeholder="Your nickname..." class="ng-pristine ng-untouched ng-valid">

http://errors.angularjs.org/1.3.0-rc.1/ngModel/nonassign?p0=config.nick&p1=%3Cinput%20type%3D%22text%22%20name%3D%22nick%22%20ng-model%3Donfig.nick%22%20ng-required%3D%22true%22%20placeholder%3D%22Your%20nickname...%22%20class%3D%22ng-pristine%20ng-untouched%20ng-valid%22%3E
    at chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:80:12
    at $$setOptions (chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:19117:13)
    at link.pre (chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:19786:19)
    at invokeLinkFn (chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:7515:9)
    at nodeLinkFn (chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:7014:11)
    at compositeLinkFn (chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:6401:13)
    at compositeLinkFn (chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:6404:13)
    at nodeLinkFn (chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:7030:24)
    at compositeLinkFn (chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:6401:13)
    at publicLinkFn (chrome-extension://mmbhiaobkilhkakjfcmldmaljcapdcgi/lib/angular/angular.js:6280:30) 

In my controller's $scope, I have $scope.config = {nick: 'SomeNick'};, so 'config.nick' should be assignable (unless there is something about CSP I don't get).

Looking into the source, it seems that (since 1.3.0-rc.1), when $parsing a simple expression (like 'config.nick'), getterFn will only have an assign attribute if CSP is disabled: https://github.com/angular/angular.js/blob/master/src/ng/parse.js#L930

Previously, the logic was (in a very high abstraction):

if (options.csp) {
    // CSP is enabled
    fn = cspSafeGetterFn(...);
} else {
    // CSP is disabled
    fn = getterFn(...);
}

// Always have an `assign` property
fn.assign = ...;

Since 1.3.0-rc.1, the logic is more like:

if (options.csp) {
    // CSP is enabled
    fn = cspSafeGetterFn(...);
} else {
    // CSP is disabled
    fn = getterFn(...);
    fn.assign = ...;
}
// No `assign` for CSP

I don't trust myself enough to touch the Parser, but I believe this is a bug :)

@caitp
Copy link
Contributor

caitp commented Sep 12, 2014

It is a bug that has been fixed today but not checked into the tree yet (will be checked in once it gets looked at by another team member) --- this is a dupe of #9048

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants