diff --git a/src/ng/compile.js b/src/ng/compile.js index fee065820bc4..bb88a8a79bca 100644 --- a/src/ng/compile.js +++ b/src/ng/compile.js @@ -1447,7 +1447,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) { (nodeName === 'img' && key === 'src')) { // sanitize a[href] and img[src] values this[key] = value = $$sanitizeUri(value, key === 'src'); - } else if (nodeName === 'img' && key === 'srcset') { + } else if (nodeName === 'img' && key === 'srcset' && isDefined(value)) { // sanitize img[srcset] values var result = ""; diff --git a/test/ng/compileSpec.js b/test/ng/compileSpec.js index 2b64f8ae8170..be52a793277b 100755 --- a/test/ng/compileSpec.js +++ b/test/ng/compileSpec.js @@ -9394,6 +9394,21 @@ describe('$compile', function() { describe('img[srcset] sanitization', function() { + it('should not error if undefined', function() { + module(function() { + directive({ + setter: valueFn(function(scope, element, attr) { + attr.$set('srcset', undefined); + expect(attr.srcset).toBeUndefined(); + }) + }); + }); + inject(function($rootScope, $compile) { + element = $compile('')($rootScope); + expect(element.attr('srcset')).toBeUndefined(); + }); + }); + it('should NOT require trusted values for img srcset', inject(function($rootScope, $compile, $sce) { element = $compile('')($rootScope); $rootScope.testUrl = 'http://example.com/image.png'; diff --git a/test/ng/directive/ngSrcsetSpec.js b/test/ng/directive/ngSrcsetSpec.js index 8d14ca5f1b79..e6842b69292b 100644 --- a/test/ng/directive/ngSrcsetSpec.js +++ b/test/ng/directive/ngSrcsetSpec.js @@ -28,5 +28,10 @@ describe('ngSrcset', function() { $rootScope.$digest(); expect(element.attr('srcset')).toBe('http://example.com/image1.png 1x,unsafe:javascript:doEvilStuff() 2x'); })); + + it('should not throw an error if undefined', inject(function($rootScope, $compile) { + element = $compile('')($rootScope); + $rootScope.$digest(); + })); });