Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

Commit dc1c180

Browse files
jbedardpetebacondarwin
jbedard
authored and
petebacondarwin
committed
fix(input): prevent browsers from autofilling hidden inputs
Autofilling with previous values (which will then be `$interpolate`ed) could lead to XSS or errors
1 parent 6592693 commit dc1c180

File tree

5 files changed

+137
-2
lines changed

5 files changed

+137
-2
lines changed

Diff for: ‎src/AngularPublic.js

+3-2
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
88
htmlAnchorDirective,
99
inputDirective,
10-
inputDirective,
10+
hiddenInputBrowserCacheDirective,
1111
formDirective,
1212
scriptDirective,
1313
selectDirective,
@@ -217,7 +217,8 @@ function publishExternalAPI(angular) {
217217
ngModelOptions: ngModelOptionsDirective
218218
}).
219219
directive({
220-
ngInclude: ngIncludeFillContentDirective
220+
ngInclude: ngIncludeFillContentDirective,
221+
input: hiddenInputBrowserCacheDirective
221222
}).
222223
directive(ngAttributeAliasDirectives).
223224
directive(ngEventDirectives);

Diff for: ‎src/ng/directive/input.js

+42
Original file line numberDiff line numberDiff line change
@@ -2139,6 +2139,48 @@ var inputDirective = ['$browser', '$sniffer', '$filter', '$parse',
21392139
}];
21402140

21412141

2142+
var hiddenInputBrowserCacheDirective = function() {
2143+
var valueProperty = {
2144+
configurable: true,
2145+
enumerable: false,
2146+
get: function() {
2147+
return this.getAttribute('value') || '';
2148+
},
2149+
set: function(val) {
2150+
this.setAttribute('value', val);
2151+
}
2152+
};
2153+
2154+
return {
2155+
restrict: 'E',
2156+
priority: 200,
2157+
compile: function(_, attr) {
2158+
if (lowercase(attr.type) !== 'hidden') {
2159+
return;
2160+
}
2161+
2162+
return {
2163+
pre: function(scope, element, attr, ctrls) {
2164+
var node = element[0];
2165+
2166+
// Support: Edge
2167+
// Moving the DOM around prevents autofillling
2168+
if (node.parentNode) {
2169+
node.parentNode.insertBefore(node, node.nextSibling);
2170+
}
2171+
2172+
// Support: FF, IE
2173+
// Avoiding direct assignment to .value prevents autofillling
2174+
if (Object.defineProperty) {
2175+
Object.defineProperty(node, 'value', valueProperty);
2176+
}
2177+
}
2178+
};
2179+
}
2180+
};
2181+
};
2182+
2183+
21422184

21432185
var CONSTANT_VALUE_REGEXP = /^(true|false|\d+)$/;
21442186
/**

Diff for: ‎test/e2e/fixtures/back2dom/index.html

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<!DOCTYPE html>
2+
<html ng-app="test">
3+
<body ng-class="{hacked: internalFnCalled}">
4+
<form>
5+
<input id="input1" type="hidden" value="{{value}}" />
6+
<input id="input2" type="hidden" ng-value="value" />
7+
8+
<textarea ng-model="value"></textarea>
9+
</form>
10+
<script src="angular.js"></script>
11+
<script src="script.js"></script>
12+
</body>
13+
</html>

Diff for: ‎test/e2e/fixtures/back2dom/script.js

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
'use strict';
2+
3+
angular
4+
.module('test', [])
5+
.run(function($rootScope) {
6+
$rootScope.internalFnCalled = false;
7+
8+
$rootScope.internalFn = function() {
9+
$rootScope.internalFnCalled = true;
10+
};
11+
});

Diff for: ‎test/e2e/tests/input-hidden.spec.js

+68
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,72 @@ describe('hidden thingy', function() {
1414
var expectedValue = browser.params.browser === 'safari' ? '{{ 7 * 6 }}' : '';
1515
expect(element(by.css('input')).getAttribute('value')).toEqual(expectedValue);
1616
});
17+
18+
it('should prevent browser autofill on browser.refresh', function() {
19+
20+
loadFixture('back2dom');
21+
expect(element(by.css('#input1')).getAttribute('value')).toEqual('');
22+
expect(element(by.css('#input2')).getAttribute('value')).toEqual('');
23+
24+
element(by.css('textarea')).sendKeys('{{ internalFn() }}');
25+
26+
expect(element(by.css('#input1')).getAttribute('value')).toEqual('{{ internalFn() }}');
27+
expect(element(by.css('#input2')).getAttribute('value')).toEqual('{{ internalFn() }}');
28+
expect(element(by.css('body')).getAttribute('class')).toBe('');
29+
30+
browser.refresh();
31+
expect(element(by.css('body')).getAttribute('class')).toBe('');
32+
});
33+
34+
it('should prevent browser autofill on location.reload', function() {
35+
36+
loadFixture('back2dom');
37+
expect(element(by.css('#input1')).getAttribute('value')).toEqual('');
38+
expect(element(by.css('#input2')).getAttribute('value')).toEqual('');
39+
40+
element(by.css('textarea')).sendKeys('{{ internalFn() }}');
41+
42+
expect(element(by.css('#input1')).getAttribute('value')).toEqual('{{ internalFn() }}');
43+
expect(element(by.css('#input2')).getAttribute('value')).toEqual('{{ internalFn() }}');
44+
expect(element(by.css('body')).getAttribute('class')).toBe('');
45+
46+
browser.driver.executeScript('location.reload()');
47+
expect(element(by.css('body')).getAttribute('class')).toBe('');
48+
});
49+
50+
it('should prevent browser autofill on history.back', function() {
51+
52+
loadFixture('back2dom');
53+
expect(element(by.css('#input1')).getAttribute('value')).toEqual('');
54+
expect(element(by.css('#input2')).getAttribute('value')).toEqual('');
55+
56+
element(by.css('textarea')).sendKeys('{{ internalFn() }}');
57+
58+
expect(element(by.css('#input1')).getAttribute('value')).toEqual('{{ internalFn() }}');
59+
expect(element(by.css('#input2')).getAttribute('value')).toEqual('{{ internalFn() }}');
60+
expect(element(by.css('body')).getAttribute('class')).toBe('');
61+
62+
loadFixture('sample');
63+
64+
browser.driver.executeScript('history.back()');
65+
expect(element(by.css('body')).getAttribute('class')).toBe('');
66+
});
67+
68+
it('should prevent browser autofill on history.forward', function() {
69+
70+
loadFixture('sample');
71+
loadFixture('back2dom');
72+
expect(element(by.css('#input1')).getAttribute('value')).toEqual('');
73+
expect(element(by.css('#input2')).getAttribute('value')).toEqual('');
74+
75+
element(by.css('textarea')).sendKeys('{{ internalFn() }}');
76+
77+
expect(element(by.css('#input1')).getAttribute('value')).toEqual('{{ internalFn() }}');
78+
expect(element(by.css('#input2')).getAttribute('value')).toEqual('{{ internalFn() }}');
79+
expect(element(by.css('body')).getAttribute('class')).toBe('');
80+
81+
browser.driver.executeScript('history.back()');
82+
browser.driver.executeScript('history.forward()');
83+
expect(element(by.css('body')).getAttribute('class')).toBe('');
84+
});
1785
});

0 commit comments

Comments
 (0)