diff --git a/src/ngSanitize/sanitize.js b/src/ngSanitize/sanitize.js index 3ccb2f78290a..80ad083b1a33 100644 --- a/src/ngSanitize/sanitize.js +++ b/src/ngSanitize/sanitize.js @@ -221,7 +221,7 @@ var htmlAttrs = makeMap('abbr,align,alt,axis,bgcolor,border,cellpadding,cellspac // SVG attributes (without "id" and "name" attributes) // https://wiki.whatwg.org/wiki/Sanitization_rules#svg_Attributes -var svgAttrs = makeMap('accent-height,accumulate,additive,alphabetic,arabic-form,ascent,' + +var svgAttrs = makeLowercaseMap('accent-height,accumulate,additive,alphabetic,arabic-form,ascent,' + 'attributeName,attributeType,baseProfile,bbox,begin,by,calcMode,cap-height,class,color,' + 'color-rendering,content,cx,cy,d,dx,dy,descent,display,dur,end,fill,fill-rule,font-family,' + 'font-size,font-stretch,font-style,font-variant,font-weight,from,fx,fy,g1,g2,glyph-name,' + @@ -249,6 +249,12 @@ function makeMap(str) { return obj; } +function makeLowercaseMap(str) { + var obj = {}, items = str.split(','), i; + for (i = 0; i < items.length; i++) obj[angular.lowercase(items[i])] = true; + return obj; +} + /** * @example diff --git a/test/ngSanitize/sanitizeSpec.js b/test/ngSanitize/sanitizeSpec.js index 2642bdf6fde9..a70e81a2b1a5 100644 --- a/test/ngSanitize/sanitizeSpec.js +++ b/test/ngSanitize/sanitizeSpec.js @@ -251,6 +251,12 @@ describe('HTML', function() { .toEqual(''); }); + it('should not ignore white-listed svg camelCased attributes', function() { + expectHTML('') + .toEqual(''); + + }); + it('should sanitize SVG xlink:href attribute values', function() { expectHTML('') .toEqual('');