Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

Commit a1611a4

Browse files
SQUASH! minor refactoring of interpolate service
Deals with @jbedard's comments.
1 parent b80eca8 commit a1611a4

File tree

1 file changed

+21
-38
lines changed

1 file changed

+21
-38
lines changed

src/ng/interpolate.js

Lines changed: 21 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -260,12 +260,12 @@ function $InterpolateProvider() {
260260
endIndex,
261261
index = 0,
262262
expressions = [],
263-
parseFns = [],
263+
parseFns,
264264
textLength = text.length,
265265
exp,
266266
concat = [],
267267
expressionPositions = [],
268-
singleExpression = false,
268+
singleExpression,
269269
contextAllowsConcatenation = isConcatenationAllowed(trustedContext);
270270

271271
while (index < textLength) {
@@ -276,7 +276,6 @@ function $InterpolateProvider() {
276276
}
277277
exp = text.substring(startIndex + startSymbolLength, endIndex);
278278
expressions.push(exp);
279-
parseFns.push($parse(exp, parseStringifyInterceptor));
280279
index = endIndex + endSymbolLength;
281280
expressionPositions.push(concat.length);
282281
concat.push(''); // Placeholder that will get replaced with the evaluated expression.
@@ -289,9 +288,10 @@ function $InterpolateProvider() {
289288
}
290289
}
291290

292-
if (concat.length === 1 && expressionPositions.length === 1) {
293-
singleExpression = true;
294-
}
291+
singleExpression = concat.length === 1 && expressionPositions.length === 1;
292+
parseFns = contextAllowsConcatenation && singleExpression ?
293+
[$parse(expressions[0])] :
294+
expressions.map(function(exp) { return $parse(exp, parseStringifyInterceptor); });
295295

296296
// Concatenating expressions makes it hard to reason about whether some combination of
297297
// concatenated values are unsafe to use and could easily lead to XSS. By requiring that a
@@ -314,32 +314,13 @@ function $InterpolateProvider() {
314314
}
315315

316316
if (contextAllowsConcatenation) {
317-
if (singleExpression) {
318-
// The raw value was left as-is by parseStringifyInterceptor
319-
return $sce.getTrusted(trustedContext, concat[0]);
320-
} else {
321-
return $sce.getTrusted(trustedContext, concat.join(''));
322-
}
323-
} else if (trustedContext) {
324-
if (concat.length > 1) {
325-
// there's at least two parts, so expr + string or exp + exp, and this context
326-
// doesn't allow that.
327-
$interpolateMinErr.throwNoconcat(text);
328-
} else {
329-
return concat.join('');
330-
}
331-
} else { // In an unprivileged context, just concatenate and return.
332-
return concat.join('');
317+
return $sce.getTrusted(trustedContext, singleExpression ? concat[0] : concat.join(''));
318+
} else if (trustedContext && concat.length > 1) {
319+
// This context does not allow more than one part, e.g. expr + string or exp + exp.
320+
$interpolateMinErr.throwNoconcat(text);
333321
}
334-
};
335-
336-
var getValue = function(value) {
337-
// In concatenable contexts, getTrusted comes at the end, to avoid sanitizing individual
338-
// parts of a full URL. We don't care about losing the trustedness here, that's handled in
339-
// parseStringifyInterceptor below.
340-
return (trustedContext && !contextAllowsConcatenation) ?
341-
$sce.getTrusted(trustedContext, value) :
342-
$sce.valueOf(value);
322+
// In an unprivileged context or only one part: just concatenate and return.
323+
return concat.join('');
343324
};
344325

345326
return extend(function interpolationFn(context) {
@@ -374,13 +355,15 @@ function $InterpolateProvider() {
374355

375356
function parseStringifyInterceptor(value) {
376357
try {
377-
if (contextAllowsConcatenation && singleExpression) {
378-
// No stringification in this case, to keep the trusted value until unwrapping.
379-
return value;
380-
} else {
381-
value = getValue(value);
382-
return allOrNothing && !isDefined(value) ? value : stringify(value);
383-
}
358+
// No stringification in this case, to keep the trusted value until unwrapping.
359+
if (contextAllowsConcatenation && singleExpression) return value;
360+
361+
// In concatenable contexts, getTrusted comes at the end, to avoid sanitizing individual
362+
// parts of a full URL. We don't care about losing the trustedness here.
363+
value = (trustedContext && !contextAllowsConcatenation) ?
364+
$sce.getTrusted(trustedContext, value) :
365+
$sce.valueOf(value);
366+
return allOrNothing && !isDefined(value) ? value : stringify(value);
384367
} catch (err) {
385368
$exceptionHandler($interpolateMinErr.interr(text, err));
386369
}

0 commit comments

Comments
 (0)