Skip to content
This repository has been archived by the owner on Apr 12, 2024. It is now read-only.

Commit

Permalink
fix(ngSanitize): call attribute setter in linky for all links
Browse files Browse the repository at this point in the history
Fixes #14707 
PR: #14710
  • Loading branch information
Narretz committed Jun 3, 2016
1 parent 2a7c37c commit c4fad6a
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 11 deletions.
22 changes: 11 additions & 11 deletions src/ngSanitize/filter/linky.js
Expand Up @@ -141,6 +141,11 @@ angular.module('ngSanitize').filter('linky', ['$sanitize', function($sanitize) {
if (text == null || text === '') return text;
if (!isString(text)) throw linkyMinErr('notstring', 'Expected string but received: {0}', text);

var attributesFn =
angular.isFunction(attributes) ? attributes :
angular.isObject(attributes) ? function getAttributesObject() {return attributes;} :
function getEmptyAttributesObject() {return {};};

var match;
var raw = text;
var html = [];
Expand Down Expand Up @@ -169,19 +174,14 @@ angular.module('ngSanitize').filter('linky', ['$sanitize', function($sanitize) {
}

function addLink(url, text) {
var key;
var key, linkAttributes = attributesFn(url);
html.push('<a ');
if (angular.isFunction(attributes)) {
attributes = attributes(url);
}
if (angular.isObject(attributes)) {
for (key in attributes) {
html.push(key + '="' + attributes[key] + '" ');
}
} else {
attributes = {};

for (key in linkAttributes) {
html.push(key + '="' + linkAttributes[key] + '" ');
}
if (angular.isDefined(target) && !('target' in attributes)) {

if (angular.isDefined(target) && !('target' in linkAttributes)) {
html.push('target="',
target,
'" ');
Expand Down
7 changes: 7 additions & 0 deletions test/ngSanitize/filter/linkySpec.js
Expand Up @@ -119,6 +119,13 @@ describe('linky', function() {
});


it('should call the attribute function for all links in the input', function() {
var attributeFn = jasmine.createSpy('attributeFn').and.returnValue({});
linky("http://example.com and http://google.com", "_self", attributeFn);
expect(attributeFn.calls.allArgs()).toEqual([['http://example.com'], ['http://google.com']]);
});


it('should strip unsafe attributes', function() {
expect(linky("http://example.com", "_self", {"class": "blue", "onclick": "alert('Hi')"})).
toBeOneOf('<a class="blue" target="_self" href="http://example.com">http://example.com</a>',
Expand Down

0 comments on commit c4fad6a

Please sign in to comment.