apply fix from angular#8975

Author: maistro-nathaniel-wooding

Dockerfile

@@ -0,0 +1,11 @@
+FROM ubuntu:18.04
+
+RUN apt-get update && apt-get install -y software-properties-common
+RUN DEBIAN_FRONTEND='noninteractive'
+RUN apt-get install -y libcurl4 curl apt-transport-https
+RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
+RUN echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
+RUN apt-get update
+RUN apt-get -y install git libuv1 yarn nodejs openjdk-8-jdk
+RUN yarn global add grunt-cli
+WORKDIR /opt/angular

src/ng/compile.js

@@ -772,6 +772,39 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
         if ((nodeName === 'A' && (key === 'href' || key === 'xlinkHref')) ||
             (nodeName === 'IMG' && key === 'src')) {
           this[key] = value = $$sanitizeUri(value, key === 'src');
+        } else if (nodeName === 'img' && key === 'srcset') {
+            // sanitize img[srcset] values
+            var result = "";
+
+            // first check if there are spaces because it's not the same pattern
+            var trimmedSrcset = trim(value);
+            //                (   999x   ,|   999w   ,|   ,|,   )
+            var srcPattern = /(\s+\d+x\s*,|\s+\d+w\s*,|\s+,|,\s+)/;
+            var pattern = /\s/.test(trimmedSrcset) ? srcPattern : /(,)/;
+
+            // split srcset into tuple of uri and descriptor except for the last item
+            var rawUris = trimmedSrcset.split(pattern);
+
+            // for each tuples
+            var nbrUrisWith2parts = Math.floor(rawUris.length / 2);
+            for (var i=0; i<nbrUrisWith2parts; i++) {
+                var innerIdx = i*2;
+                // sanitize the uri
+                result += $$sanitizeUri(trim( rawUris[innerIdx]), true);
+                // add the descriptor
+                result += ( " " + trim(rawUris[innerIdx+1]));
+            }
+            // split the last item into uri and descriptor
+            var lastTuple = trim(rawUris[i*2]).split(/\s/);
+
+            // sanitize the last uri
+            result += $$sanitizeUri(trim(lastTuple[0]), true);
+
+            // and add the last descriptor if any
+            if( lastTuple.length === 2) {
+                result += (" " + trim(lastTuple[1]));
+            }
+            this[key] = value = result;
         }
 
         if (writeAttr !== false) {