fixup! feat($compile): add support for arbitrary property and event bindings

Jason Bedard · Jason Bedard · commit fae50665e872 · 2018-07-19T00:02:31.000-07:00
diff --git a/test/ng/compileSpec.js b/test/ng/compileSpec.js
@@ -12179,6 +12179,70 @@ describe('$compile', function() {
         $compileProvider.addPropertySecurityContext('div', 'title', 'mediaUrl');
       });
     });
+
+    it('should enforce the specified sce type for properties added for specific elements', function() {
+      module(function($compileProvider) {
+        $compileProvider.addPropertySecurityContext('div', 'foo', 'mediaUrl');
+      });
+      inject(function($compile, $rootScope, $sce) {
+        var element = $compile('<div ng-prop-foo="bar"></div>')($rootScope);
+
+        $rootScope.bar = 'untrusted:test1';
+        $rootScope.$apply();
+        expect(element.prop('foo')).toBe('unsafe:untrusted:test1');
+
+        $rootScope.bar = $sce.trustAsCss('untrusted:test2');
+        $rootScope.$apply();
+        expect(element.prop('foo')).toBe('unsafe:untrusted:test2');
+
+        $rootScope.bar = $sce.trustAsMediaUrl('untrusted:test3');
+        $rootScope.$apply();
+        expect(element.prop('foo')).toBe('untrusted:test3');
+      });
+    });
+
+    it('should enforce the specified sce type for properties added for all elements (*)', function() {
+      module(function($compileProvider) {
+        $compileProvider.addPropertySecurityContext('*', 'foo', 'mediaUrl');
+      });
+      inject(function($compile, $rootScope, $sce) {
+        var element = $compile('<div ng-prop-foo="bar"></div>')($rootScope);
+
+        $rootScope.bar = 'untrusted:test1';
+        $rootScope.$apply();
+        expect(element.prop('foo')).toBe('unsafe:untrusted:test1');
+
+        $rootScope.bar = $sce.trustAsCss('untrusted:test2');
+        $rootScope.$apply();
+        expect(element.prop('foo')).toBe('unsafe:untrusted:test2');
+
+        $rootScope.bar = $sce.trustAsMediaUrl('untrusted:test3');
+        $rootScope.$apply();
+        expect(element.prop('foo')).toBe('untrusted:test3');
+      });
+    });
+
+    it('should enforce the specific sce type when both an element specific and generic exist', function() {
+      module(function($compileProvider) {
+        $compileProvider.addPropertySecurityContext('*', 'foo', 'css');
+        $compileProvider.addPropertySecurityContext('div', 'foo', 'mediaUrl');
+      });
+      inject(function($compile, $rootScope, $sce) {
+        var element = $compile('<div ng-prop-foo="bar"></div>')($rootScope);
+
+        $rootScope.bar = 'untrusted:test1';
+        $rootScope.$apply();
+        expect(element.prop('foo')).toBe('unsafe:untrusted:test1');
+
+        $rootScope.bar = $sce.trustAsCss('untrusted:test2');
+        $rootScope.$apply();
+        expect(element.prop('foo')).toBe('unsafe:untrusted:test2');
+
+        $rootScope.bar = $sce.trustAsMediaUrl('untrusted:test3');
+        $rootScope.$apply();
+        expect(element.prop('foo')).toBe('untrusted:test3');
+      });
+    });
   });
 
 
