Skip to content
This repository has been archived by the owner on Apr 12, 2024. It is now read-only.

Commit

Permalink
fix(minErr): encode btstrpd error input to strip angle brackets
Browse files Browse the repository at this point in the history
The $sanitize service was returning an empty string to the error page
because the input was usually a single html tag (sometimes it could be
`document`). This fix replaces angle brackets with html entities.

Closes #8683
  • Loading branch information
jeffbcross committed Aug 21, 2014
1 parent 893d2f8 commit aaf9c5e
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 2 deletions.
6 changes: 5 additions & 1 deletion src/Angular.js
Original file line number Diff line number Diff line change
Expand Up @@ -1345,7 +1345,11 @@ function bootstrap(element, modules) {

if (element.injector()) {
var tag = (element[0] === document) ? 'document' : startingTag(element);
throw ngMinErr('btstrpd', "App Already Bootstrapped with this Element '{0}'", tag);
//Encode angle brackets to prevent input from being sanitized to empty string #8683
throw ngMinErr(
'btstrpd',
"App Already Bootstrapped with this Element '{0}'",
tag.replace(/</,'&lt;').replace(/>/,'&gt;'));
}

modules = modules || [];
Expand Down
2 changes: 1 addition & 1 deletion test/AngularSpec.js
Original file line number Diff line number Diff line change
Expand Up @@ -822,7 +822,7 @@ describe('angular', function() {
expect(function () {
angular.bootstrap(element);
}).toThrowMatching(
/\[ng:btstrpd\] App Already Bootstrapped with this Element '<div class="?ng\-scope"?( ng[0-9]+="?[0-9]+"?)?>'/i
/\[ng:btstrpd\] App Already Bootstrapped with this Element '&lt;div class="?ng\-scope"?( ng[0-9]+="?[0-9]+"?)?&gt;'/i
);

dealoc(element);
Expand Down

0 comments on commit aaf9c5e

Please sign in to comment.