Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

fix(angularInit): allow auto-bootstraping from inline script #15571

Closed
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions src/Angular.js
Original file line number Diff line number Diff line change
Expand Up @@ -1479,12 +1479,16 @@ function getNgAttribute(element, ngAttr) {
}

function allowAutoBootstrap(document) {
if (!document.currentScript) {
var script = document.currentScript;
var src = script && script.getAttribute('src');

if (!src) {
return true;
}
var src = document.currentScript.getAttribute('src');

var link = document.createElement('a');
link.href = src;

if (document.location.origin === link.origin) {
// Same-origin resources are always allowed, even for non-whitelisted schemes.
return true;
Expand Down
25 changes: 23 additions & 2 deletions test/AngularSpec.js
Original file line number Diff line number Diff line change
Expand Up @@ -1684,7 +1684,8 @@ describe('angular', function() {
});

it('should bootstrap from an extension into an extension document for same-origin documents only', function() {
if (msie) return; // IE does not support document.currentScript (nor extensions with protocol), so skip test.
// IE does not support `document.currentScript` (nor extensions with protocol), so skip test.
if (msie) return;

// Extension URLs are browser-specific, so we must choose a scheme that is supported by the browser to make
// sure that the URL is properly parsed.
Expand Down Expand Up @@ -1715,8 +1716,28 @@ describe('angular', function() {
expect(allowAutoBootstrap(fakeDoc)).toBe(false);
});

it('should bootstrap from a script with an empty or missing `src` attribute', function() {
// IE does not support `document.currentScript` (nor extensions with protocol), so skip test.
if (msie) return;

// Fake a minimal document object (the actual document.currentScript is readonly).
var src;
var fakeDoc = {
createElement: document.createElement.bind(document),
currentScript: {getAttribute: function() { return src; }},
location: {origin: 'some-value', protocol: 'http:'}
};

src = null;
expect(allowAutoBootstrap(fakeDoc)).toBe(true);

src = '';
expect(allowAutoBootstrap(fakeDoc)).toBe(true);
});

it('should not bootstrap from an extension into a non-extension document', function() {
if (msie) return; // IE does not support document.currentScript (nor extensions with protocol), so skip test.
// IE does not support `document.currentScript` (nor extensions with protocol), so skip test.
if (msie) return;

var src = 'resource://something';
// Fake a minimal document object (the actual document.currentScript is readonly).
Expand Down