diff --git a/src/ngSanitize/sanitize.js b/src/ngSanitize/sanitize.js index 48ddad82341..cebf0228fd8 100644 --- a/src/ngSanitize/sanitize.js +++ b/src/ngSanitize/sanitize.js @@ -421,50 +421,28 @@ function $SanitizeProvider() { } /** - * Create an inert document that contains the dirty HTML that needs sanitizing - * Depending upon browser support we use one of three strategies for doing this. - * Support: Safari 10.x -> XHR strategy - * Support: Firefox -> DomParser strategy + * Create an inert document that contains the dirty HTML that needs sanitizing. + * We use the DOMParser API by default and fall back to createHTMLDocument if DOMParser is not + * available. */ var getInertBodyElement /* function(html: string): HTMLBodyElement */ = (function(window, document) { - var inertDocument; - if (document && document.implementation) { - inertDocument = document.implementation.createHTMLDocument('inert'); - } else { - throw $sanitizeMinErr('noinert', 'Can\'t create an inert html document'); + if (isDOMParserAvailable()) { + return getInertBodyElement_DOMParser; } - var inertBodyElement = (inertDocument.documentElement || inertDocument.getDocumentElement()).querySelector('body'); - // Check for the Safari 10.1 bug - which allows JS to run inside the SVG G element - inertBodyElement.innerHTML = ''; - if (!inertBodyElement.querySelector('svg')) { - return getInertBodyElement_XHR; - } else { - // Check for the Firefox bug - which prevents the inner img JS from being sanitized - inertBodyElement.innerHTML = '

'; - if (inertBodyElement.querySelector('svg img')) { - return getInertBodyElement_DOMParser; - } else { - return getInertBodyElement_InertDocument; - } + if (!document || !document.implementation) { + throw $sanitizeMinErr('noinert', 'Can\'t create an inert html document'); } + var inertDocument = document.implementation.createHTMLDocument('inert'); + var inertBodyElement = (inertDocument.documentElement || inertDocument.getDocumentElement()).querySelector('body'); + return getInertBodyElement_InertDocument; - function getInertBodyElement_XHR(html) { - // We add this dummy element to ensure that the rest of the content is parsed as expected - // e.g. leading whitespace is maintained and tags like `` do not get hoisted to the `` tag. - html = '' + html; + function isDOMParserAvailable() { try { - html = encodeURI(html); + return !!getInertBodyElement_DOMParser(''); } catch (e) { - return undefined; + return false; } - var xhr = new window.XMLHttpRequest(); - xhr.responseType = 'document'; - xhr.open('GET', 'data:text/html;charset=utf-8,' + html, false); - xhr.send(null); - var body = xhr.response.body; - body.firstChild.remove(); - return body; } function getInertBodyElement_DOMParser(html) {