fixup! feat($compile): add support for arbitrary property and event bindings

Author: jbedard

test/ng/ngPropSpec.js

@@ -236,6 +236,26 @@ describe('ngProp*', function() {
           $rootScope.$digest();
           expect(element.prop('src')).toEqual('untrusted:foo()');
         }));
+
+        it('should sanitize non-whitelisted values', inject(function($rootScope, $compile, $sce) {
+          // As a MEDIA_URL URL
+          var element = $compile('<' + tag + ' ng-prop-src="testUrl"></' + tag + '>')($rootScope);
+          // Some browsers complain if you try to write `javascript:` into an `img[src]`
+          // So for the test use something different
+          $rootScope.testUrl = 'untrusted:foo()';
+          $rootScope.$digest();
+          expect(element.prop('src')).toEqual('unsafe:untrusted:foo()');
+        }));
+
+        it('should sanitize wrongly typed values', inject(function($rootScope, $compile, $sce) {
+          // As a MEDIA_URL URL
+          var element = $compile('<' + tag + ' ng-prop-src="testUrl"></' + tag + '>')($rootScope);
+          // Some browsers complain if you try to write `javascript:` into an `img[src]`
+          // So for the test use something different
+          $rootScope.testUrl = $sce.trustAsCss('untrusted:foo()');
+          $rootScope.$digest();
+          expect(element.prop('src')).toEqual('unsafe:untrusted:foo()');
+        }));
       });
     }
   });
@@ -272,6 +292,20 @@ describe('ngProp*', function() {
           $rootScope.$digest();
           expect(element.find(tag).prop('src')).toEqual('javascript:foo()');
         }));
+
+        it('should sanitize non-whitelisted values', inject(function($rootScope, $compile, $sce) {
+          var element = $compile('<video><' + tag + ' ng-prop-src="testUrl"></' + tag + '></video>')($rootScope);
+          $rootScope.testUrl = 'untrusted:foo()';
+          $rootScope.$digest();
+          expect(element.find(tag).prop('src')).toEqual('unsafe:untrusted:foo()');
+        }));
+
+        it('should sanitize wrongly typed values', inject(function($rootScope, $compile, $sce) {
+          var element = $compile('<video><' + tag + ' ng-prop-src="testUrl"></' + tag + '></video>')($rootScope);
+          $rootScope.testUrl = $sce.trustAsCss('untrusted:foo()');
+          $rootScope.$digest();
+          expect(element.find(tag).prop('src')).toEqual('unsafe:untrusted:foo()');
+        }));
       });
     });
   }