Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

Commit 234053f

Browse files
committed
fix(ngSanitize): Blacklist the attribute usemap
Given that the attribute `name` is blacklisted, the attribute `usemap` should be blacklisted too. Closes: ##13826
1 parent a277bcf commit 234053f

File tree

2 files changed

+2
-1
lines changed

2 files changed

+2
-1
lines changed

src/ngSanitize/sanitize.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ var validElements = angular.extend({},
254254
optionalEndTagElements);
255255

256256
//Attributes that have href and hence need to be sanitized
257-
var uriAttrs = toMap("background,cite,href,longdesc,src,usemap,xlink:href");
257+
var uriAttrs = toMap("background,cite,href,longdesc,src,xlink:href");
258258

259259
var htmlAttrs = toMap('abbr,align,alt,axis,bgcolor,border,cellpadding,cellspacing,class,clear,' +
260260
'color,cols,colspan,compact,coords,dir,face,headers,height,hreflang,hspace,' +

test/ngSanitize/sanitizeSpec.js

+1
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ describe('HTML', function() {
153153

154154
it('should remove unsafe value', function() {
155155
expectHTML('<a href="javascript:alert()">').toEqual('<a></a>');
156+
expectHTML('<img src="foo.gif" usemap="#foomap">').toEqual('<img src="foo.gif">');
156157
});
157158

158159
it('should handle self closed elements', function() {

0 commit comments

Comments
 (0)