`.
+ * The new behavior is a security fix so if you use this method, please try to adjust
+ * to the change & remove the call as soon as possible.
+ * Note that this only patches jqLite. If you use jQuery 3.5.0 or newer, please read
+ * [jQuery 3.5 upgrade guide](https://jquery.com/upgrade-guide/3.5/) for more details
+ * about the workarounds.
+ */
+function UNSAFE_restoreLegacyJqLiteXHTMLReplacement() {
+ JQLite.legacyXHTMLReplacement = true;
+}
+
/**
* throw error if the argument is falsy.
*/
diff --git a/src/AngularPublic.js b/src/AngularPublic.js
index b81257b9fff7..0c7df395dc0b 100644
--- a/src/AngularPublic.js
+++ b/src/AngularPublic.js
@@ -116,6 +116,7 @@ function publishExternalAPI(angular) {
'bootstrap': bootstrap,
'copy': copy,
'extend': extend,
+ 'merge': merge,
'equals': equals,
'element': jqLite,
'forEach': forEach,
@@ -141,7 +142,8 @@ function publishExternalAPI(angular) {
'getTestability': getTestability,
'$$minErr': minErr,
'$$csp': csp,
- 'reloadWithDebugInfo': reloadWithDebugInfo
+ 'reloadWithDebugInfo': reloadWithDebugInfo,
+ 'UNSAFE_restoreLegacyJqLiteXHTMLReplacement': UNSAFE_restoreLegacyJqLiteXHTMLReplacement
});
angularModule = setupModuleLoader(window);
diff --git a/src/jqLite.js b/src/jqLite.js
index dfdad1c0ee17..bb24caec0905 100644
--- a/src/jqLite.js
+++ b/src/jqLite.js
@@ -158,7 +158,6 @@ var XHTML_TAG_REGEXP = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w
var wrapMap = {
'option': [1, ''],
-
'thead': [1, '
', '
'],
'col': [2, '
', '
'],
'tr': [2, '
', '
'],
@@ -170,6 +169,21 @@ wrapMap.optgroup = wrapMap.option;
wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead;
wrapMap.th = wrapMap.td;
+// Support: IE <10 only
+// IE 9 requires an option wrapper & it needs to have the whole table structure
+// set up up front; assigning `"
"` to `tr.innerHTML` doesn't work, etc.
+var wrapMapIE9 = {
+ option: [1, ''],
+ _default: [0, '', '']
+};
+
+for (var key in wrapMap) {
+ var wrapMapValueClosing = wrapMap[key];
+ var wrapMapValue = wrapMapValueClosing.slice().reverse();
+ wrapMapIE9[key] = [wrapMapValue.length, '<' + wrapMapValue.join('><') + '>', ''];
+}
+
+wrapMapIE9.optgroup = wrapMapIE9.option;
function jqLiteIsTextNode(html) {
return !HTML_REGEXP.test(html);
@@ -183,7 +197,7 @@ function jqLiteAcceptsData(node) {
}
function jqLiteBuildFragment(html, context) {
- var tmp, tag, wrap,
+ var tmp, tag, wrap, finalHtml,
fragment = context.createDocumentFragment(),
nodes = [], i;
@@ -194,13 +208,30 @@ function jqLiteBuildFragment(html, context) {
// Convert html into DOM nodes
tmp = tmp || fragment.appendChild(context.createElement("div"));
tag = (TAG_NAME_REGEXP.exec(html) || ["", ""])[1].toLowerCase();
- wrap = wrapMap[tag] || wrapMap._default;
- tmp.innerHTML = wrap[1] + html.replace(XHTML_TAG_REGEXP, "<$1>") + wrap[2];
+ finalHtml = JQLite.legacyXHTMLReplacement ?
+ html.replace(XHTML_TAG_REGEXP, '<$1>') :
+ html;
+
+ if (msie < 10) {
+ wrap = wrapMapIE9[tag] || wrapMapIE9._default;
+ tmp.innerHTML = wrap[1] + finalHtml + wrap[2];
+
+ // Descend through wrappers to the right content
+ i = wrap[0];
+ while (i--) {
+ tmp = tmp.firstChild;
+ }
+ } else {
+ wrap = wrapMap[tag] || wrapMap._default;
- // Descend through wrappers to the right content
- i = wrap[0];
- while (i--) {
- tmp = tmp.lastChild;
+
+ tmp.innerHTML = wrap[1] + finalHtml + wrap[2];
+
+ // Descend through wrappers to the right content
+ i = wrap[0];
+ while (i--) {
+ tmp = tmp.lastChild;
+ }
}
nodes = concat(nodes, tmp.childNodes);
diff --git a/src/ng/compile.js b/src/ng/compile.js
index 051028e338e8..5c1d04a140c6 100644
--- a/src/ng/compile.js
+++ b/src/ng/compile.js
@@ -1044,7 +1044,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
nodeName = nodeName_(this.$$element);
- if ((nodeName === 'a' && key === 'href') ||
+ if ((nodeName === 'a' && (key === 'href' || key === 'xlinkHref')) ||
(nodeName === 'img' && key === 'src')) {
// sanitize a[href] and img[src] values
this[key] = value = $$sanitizeUri(value, key === 'src');
diff --git a/test/AngularSpec.js b/test/AngularSpec.js
index 0f353f01fe45..1c79c984565b 100644
--- a/test/AngularSpec.js
+++ b/test/AngularSpec.js
@@ -1580,3 +1580,82 @@ describe('angular', function() {
});
});
});
+describe('merge', function () {
+ it('should recursively copy objects into dst from left to right', function () {
+ var dst = {foo: {bar: 'foobar'}};
+ var src1 = {foo: {bazz: 'foobazz'}};
+ var src2 = {foo: {bozz: 'foobozz'}};
+ merge(dst, src1, src2);
+ expect(dst).toEqual({
+ foo: {
+ bar: 'foobar',
+ bazz: 'foobazz',
+ bozz: 'foobozz'
+ }
+ });
+ });
+
+
+ it('should replace primitives with objects', function () {
+ var dst = {foo: "bloop"};
+ var src = {foo: {bar: {baz: "bloop"}}};
+ merge(dst, src);
+ expect(dst).toEqual({
+ foo: {
+ bar: {
+ baz: "bloop"
+ }
+ }
+ });
+ });
+
+
+ it('should replace null values in destination with objects', function () {
+ var dst = {foo: null};
+ var src = {foo: {bar: {baz: "bloop"}}};
+ merge(dst, src);
+ expect(dst).toEqual({
+ foo: {
+ bar: {
+ baz: "bloop"
+ }
+ }
+ });
+ });
+
+ it('should copy references to functions by value rather than merging', function () {
+ function fn() {
+ }
+
+ var dst = {foo: 1};
+ var src = {foo: fn};
+ merge(dst, src);
+ expect(dst).toEqual({
+ foo: fn
+ });
+ });
+
+
+ it('should create a new array if destination property is a non-object and source property is an array', function () {
+ var dst = {foo: NaN};
+ var src = {foo: [1, 2, 3]};
+ merge(dst, src);
+ expect(dst).toEqual({
+ foo: [1, 2, 3]
+ });
+ expect(dst.foo).not.toBe(src.foo);
+ });
+
+ it('should not merge the __proto__ property', function() {
+ var src = JSON.parse('{ "__proto__": { "xxx": "polluted" } }');
+ var dst = {};
+
+ merge(dst, src);
+
+ if (typeof dst.__proto__ !== 'undefined') { // eslint-disable-line
+ // Should not overwrite the __proto__ property or pollute the Object prototype
+ expect(dst.__proto__).toBe(Object.prototype); // eslint-disable-line
+ }
+ expect(({}).xxx).toBeUndefined();
+ });
+});
diff --git a/test/jqLiteSpec.js b/test/jqLiteSpec.js
index a791641bcda0..e31e37648294 100644
--- a/test/jqLiteSpec.js
+++ b/test/jqLiteSpec.js
@@ -26,8 +26,8 @@ describe('jqLite', function() {
var expect = jqLite(expected[i])[0];
value = value && equals(expect, actual);
msg = "Not equal at index: " + i
- + " - Expected: " + expect
- + " - Actual: " + actual;
+ + " - Expected: " + expect
+ + " - Actual: " + actual;
}
return value;
}
@@ -129,6 +129,67 @@ describe('jqLite', function() {
});
});
+ describe('security', function() {
+
+ it('shouldn\'t unsanitize sanitized code', function(done) {
+ var counter = 0,
+ assertCount = 13,
+ container = jqLite('');
+
+ function donePartial() {
+ counter++;
+ if (counter === assertCount) {
+ container.remove();
+ delete window.xss;
+ }
+ }
+
+ jqLite(document.body).append(container);
+ window.xss = jasmine.createSpy('xss');
+
+ // Thanks to Masato Kinugawa from Cure53 for providing the following test cases.
+ // Note: below test cases need to invoke the xss function with consecutive
+ // decimal parameters for the assertions to be correct.
+ forEach([
+ '',
+ '',
+ '