diff --git a/src/.jshintrc b/src/.jshintrc index 241e3feccb19..c9c3d119946c 100644 --- a/src/.jshintrc +++ b/src/.jshintrc @@ -65,6 +65,7 @@ "shallowCopy": false, "equals": false, "csp": false, + "unsafeEval": false, "concat": false, "sliceArgs": false, "bind": false, diff --git a/src/Angular.js b/src/Angular.js index 824c0a9d70c8..f2d40d648a11 100644 --- a/src/Angular.js +++ b/src/Angular.js @@ -978,22 +978,27 @@ function equals(o1, o2) { return false; } +var unsafeEval = function() { /* jshint ignore:line */ + if (isDefined(unsafeEval.isActive_)) return unsafeEval.isActive_; + + var active = true; + try { + /* jshint -W031, -W054 */ + new Function(''); + /* jshint +W031, +W054 */ + } catch (e) { + active = false; + } + return (unsafeEval.isActive_ = active); +}; + var csp = function() { if (isDefined(csp.isActive_)) return csp.isActive_; var active = !!(document.querySelector('[ng-csp]') || document.querySelector('[data-ng-csp]')); - if (!active) { - try { - /* jshint -W031, -W054 */ - new Function(''); - /* jshint +W031, +W054 */ - } catch (e) { - active = true; - } - } - + active = active || !unsafeEval(); return (csp.isActive_ = active); }; diff --git a/src/ng/parse.js b/src/ng/parse.js index 7084acb1d46a..2f84931fb954 100644 --- a/src/ng/parse.js +++ b/src/ng/parse.js @@ -1698,12 +1698,14 @@ function $ParseProvider() { var cacheExpensive = createMap(); this.$get = ['$filter', '$sniffer', function($filter, $sniffer) { + var csp = $sniffer.csp && !$sniffer.unsafeEval; + var $parseOptions = { - csp: $sniffer.csp, + csp: csp, expensiveChecks: false }, $parseOptionsExpensive = { - csp: $sniffer.csp, + csp: csp, expensiveChecks: true }; diff --git a/src/ng/sniffer.js b/src/ng/sniffer.js index 7c9f5ee3b26a..48aa5dc47ab2 100644 --- a/src/ng/sniffer.js +++ b/src/ng/sniffer.js @@ -79,6 +79,7 @@ function $SnifferProvider() { return eventSupport[event]; }, csp: csp(), + unsafeEval: unsafeEval(), vendorPrefix: vendorPrefix, transitions: transitions, animations: animations, diff --git a/test/.jshintrc b/test/.jshintrc index 0d85795b3545..90d1042afd42 100644 --- a/test/.jshintrc +++ b/test/.jshintrc @@ -61,6 +61,7 @@ "shallowCopy": false, "equals": false, "csp": false, + "unsafeEval": false, "jq": false, "concat": false, "sliceArgs": false, diff --git a/test/AngularSpec.js b/test/AngularSpec.js index 36101bbe707b..a1e3430f2f88 100644 --- a/test/AngularSpec.js +++ b/test/AngularSpec.js @@ -711,6 +711,7 @@ describe('angular', function() { afterEach(function() { window.Function = originalFunction; delete csp.isActive_; + delete unsafeEval.isActive_; });