13
13
14
14
var $parseMinErr = minErr ( '$parse' ) ;
15
15
16
+ var ARRAY_CTOR = [ ] . constructor ;
17
+ var BOOLEAN_CTOR = ( false ) . constructor ;
18
+ var FUNCTION_CTOR = Function . constructor ;
19
+ var NUMBER_CTOR = ( 0 ) . constructor ;
20
+ var OBJECT_CTOR = { } . constructor ;
21
+ var STRING_CTOR = '' . constructor ;
22
+ var ARRAY_CTOR_PROTO = ARRAY_CTOR . prototype ;
23
+ var BOOLEAN_CTOR_PROTO = BOOLEAN_CTOR . prototype ;
24
+ var FUNCTION_CTOR_PROTO = FUNCTION_CTOR . prototype ;
25
+ var NUMBER_CTOR_PROTO = NUMBER_CTOR . prototype ;
26
+ var OBJECT_CTOR_PROTO = OBJECT_CTOR . prototype ;
27
+ var STRING_CTOR_PROTO = STRING_CTOR . prototype ;
28
+
29
+ var CALL = FUNCTION_CTOR_PROTO . call ;
30
+ var APPLY = FUNCTION_CTOR_PROTO . apply ;
31
+ var BIND = FUNCTION_CTOR_PROTO . bind ;
32
+
33
+ var objectValueOf = OBJECT_CTOR_PROTO . valueOf ;
34
+
16
35
// Sandboxing Angular Expressions
17
36
// ------------------------------
18
37
// Angular expressions are generally considered safe because these expressions only have direct
@@ -93,10 +112,6 @@ function ensureSafeObject(obj, fullExpression) {
93
112
return obj ;
94
113
}
95
114
96
- var CALL = Function . prototype . call ;
97
- var APPLY = Function . prototype . apply ;
98
- var BIND = Function . prototype . bind ;
99
-
100
115
function ensureSafeFunction ( obj , fullExpression ) {
101
116
if ( obj ) {
102
117
if ( obj . constructor === obj ) {
@@ -113,25 +128,18 @@ function ensureSafeFunction(obj, fullExpression) {
113
128
114
129
function ensureSafeAssignContext ( obj , fullExpression ) {
115
130
if ( obj ) {
116
- var booleanConstructor = ( false ) . constructor ;
117
- var numberConstructor = ( 0 ) . constructor ;
118
- var stringConstructor = '' . constructor ;
119
- var objectConstructor = { } . constructor ;
120
- var arrayConstructor = [ ] . constructor ;
121
- var functionConstructor = Function . constructor ;
122
-
123
- if ( obj === booleanConstructor ||
124
- obj === numberConstructor ||
125
- obj === stringConstructor ||
126
- obj === objectConstructor ||
127
- obj === arrayConstructor ||
128
- obj === functionConstructor ||
129
- obj === booleanConstructor . prototype ||
130
- obj === numberConstructor . prototype ||
131
- obj === stringConstructor . prototype ||
132
- obj === objectConstructor . prototype ||
133
- obj === arrayConstructor . prototype ||
134
- obj === functionConstructor . prototype ) {
131
+ if ( obj === ARRAY_CTOR ||
132
+ obj === BOOLEAN_CTOR ||
133
+ obj === FUNCTION_CTOR ||
134
+ obj === NUMBER_CTOR ||
135
+ obj === OBJECT_CTOR ||
136
+ obj === STRING_CTOR ||
137
+ obj === ARRAY_CTOR_PROTO ||
138
+ obj === BOOLEAN_CTOR_PROTO ||
139
+ obj === FUNCTION_CTOR_PROTO ||
140
+ obj === NUMBER_CTOR_PROTO ||
141
+ obj === OBJECT_CTOR_PROTO ||
142
+ obj === STRING_CTOR_PROTO ) {
135
143
throw $parseMinErr ( 'isecaf' ,
136
144
'Assigning to a constructor or its prototype is disallowed! Expression: {0}' ,
137
145
fullExpression ) ;
@@ -1794,8 +1802,6 @@ function isPossiblyDangerousMemberName(name) {
1794
1802
return name === 'constructor' ;
1795
1803
}
1796
1804
1797
- var objectValueOf = Object . prototype . valueOf ;
1798
-
1799
1805
function getValueOf ( value ) {
1800
1806
return isFunction ( value . valueOf ) ? value . valueOf ( ) : objectValueOf . call ( value ) ;
1801
1807
}
0 commit comments