Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

fix(minErr): encode btstrpd error input to strip angle brackets #8700

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion src/Angular.js
Original file line number Diff line number Diff line change
Expand Up @@ -1395,7 +1395,11 @@ function bootstrap(element, modules, config) {

if (element.injector()) {
var tag = (element[0] === document) ? 'document' : startingTag(element);
throw ngMinErr('btstrpd', "App Already Bootstrapped with this Element '{0}'", tag);
//Encode angle brackets to prevent input from being sanitized to empty string #8683
throw ngMinErr(
'btstrpd',
"App Already Bootstrapped with this Element '{0}'",
tag.replace(/</,'&lt;').replace(/>/,'&gt;'));
}

modules = modules || [];
Expand Down
2 changes: 1 addition & 1 deletion test/AngularSpec.js
Original file line number Diff line number Diff line change
Expand Up @@ -786,7 +786,7 @@ describe('angular', function() {
expect(function () {
angular.bootstrap(element);
}).toThrowMatching(
/\[ng:btstrpd\] App Already Bootstrapped with this Element '<div class="?ng\-scope"?( ng[0-9]+="?[0-9]+"?)?>'/i
/\[ng:btstrpd\] App Already Bootstrapped with this Element '&lt;div class="?ng\-scope"?( ng[0-9]+="?[0-9]+"?)?&gt;'/i
);

dealoc(element);
Expand Down