@@ -260,12 +260,12 @@ function $InterpolateProvider() {
260
260
endIndex ,
261
261
index = 0 ,
262
262
expressions = [ ] ,
263
- parseFns = [ ] ,
263
+ parseFns ,
264
264
textLength = text . length ,
265
265
exp ,
266
266
concat = [ ] ,
267
267
expressionPositions = [ ] ,
268
- singleExpression = false ,
268
+ singleExpression ,
269
269
contextAllowsConcatenation = isConcatenationAllowed ( trustedContext ) ;
270
270
271
271
while ( index < textLength ) {
@@ -276,7 +276,6 @@ function $InterpolateProvider() {
276
276
}
277
277
exp = text . substring ( startIndex + startSymbolLength , endIndex ) ;
278
278
expressions . push ( exp ) ;
279
- parseFns . push ( $parse ( exp , parseStringifyInterceptor ) ) ;
280
279
index = endIndex + endSymbolLength ;
281
280
expressionPositions . push ( concat . length ) ;
282
281
concat . push ( '' ) ; // Placeholder that will get replaced with the evaluated expression.
@@ -289,9 +288,10 @@ function $InterpolateProvider() {
289
288
}
290
289
}
291
290
292
- if ( concat . length === 1 && expressionPositions . length === 1 ) {
293
- singleExpression = true ;
294
- }
291
+ singleExpression = concat . length === 1 && expressionPositions . length === 1 ;
292
+ parseFns = contextAllowsConcatenation && singleExpression ?
293
+ [ $parse ( expressions [ 0 ] ) ] :
294
+ expressions . map ( function ( exp ) { return $parse ( exp , parseStringifyInterceptor ) ; } ) ;
295
295
296
296
// Concatenating expressions makes it hard to reason about whether some combination of
297
297
// concatenated values are unsafe to use and could easily lead to XSS. By requiring that a
@@ -314,32 +314,13 @@ function $InterpolateProvider() {
314
314
}
315
315
316
316
if ( contextAllowsConcatenation ) {
317
- if ( singleExpression ) {
318
- // The raw value was left as-is by parseStringifyInterceptor
319
- return $sce . getTrusted ( trustedContext , concat [ 0 ] ) ;
320
- } else {
321
- return $sce . getTrusted ( trustedContext , concat . join ( '' ) ) ;
322
- }
323
- } else if ( trustedContext ) {
324
- if ( concat . length > 1 ) {
325
- // there's at least two parts, so expr + string or exp + exp, and this context
326
- // doesn't allow that.
327
- $interpolateMinErr . throwNoconcat ( text ) ;
328
- } else {
329
- return concat . join ( '' ) ;
330
- }
331
- } else { // In an unprivileged context, just concatenate and return.
332
- return concat . join ( '' ) ;
317
+ return $sce . getTrusted ( trustedContext , singleExpression ? concat [ 0 ] : concat . join ( '' ) ) ;
318
+ } else if ( trustedContext && concat . length > 1 ) {
319
+ // This context does not allow more than one part, e.g. expr + string or exp + exp.
320
+ $interpolateMinErr . throwNoconcat ( text ) ;
333
321
}
334
- } ;
335
-
336
- var getValue = function ( value ) {
337
- // In concatenable contexts, getTrusted comes at the end, to avoid sanitizing individual
338
- // parts of a full URL. We don't care about losing the trustedness here, that's handled in
339
- // parseStringifyInterceptor below.
340
- return ( trustedContext && ! contextAllowsConcatenation ) ?
341
- $sce . getTrusted ( trustedContext , value ) :
342
- $sce . valueOf ( value ) ;
322
+ // In an unprivileged context or only one part: just concatenate and return.
323
+ return concat . join ( '' ) ;
343
324
} ;
344
325
345
326
return extend ( function interpolationFn ( context ) {
@@ -374,13 +355,15 @@ function $InterpolateProvider() {
374
355
375
356
function parseStringifyInterceptor ( value ) {
376
357
try {
377
- if ( contextAllowsConcatenation && singleExpression ) {
378
- // No stringification in this case, to keep the trusted value until unwrapping.
379
- return value ;
380
- } else {
381
- value = getValue ( value ) ;
382
- return allOrNothing && ! isDefined ( value ) ? value : stringify ( value ) ;
383
- }
358
+ // No stringification in this case, to keep the trusted value until unwrapping.
359
+ if ( contextAllowsConcatenation && singleExpression ) return value ;
360
+
361
+ // In concatenable contexts, getTrusted comes at the end, to avoid sanitizing individual
362
+ // parts of a full URL. We don't care about losing the trustedness here.
363
+ value = ( trustedContext && ! contextAllowsConcatenation ) ?
364
+ $sce . getTrusted ( trustedContext , value ) :
365
+ $sce . valueOf ( value ) ;
366
+ return allOrNothing && ! isDefined ( value ) ? value : stringify ( value ) ;
384
367
} catch ( err ) {
385
368
$exceptionHandler ( $interpolateMinErr . interr ( text , err ) ) ;
386
369
}
0 commit comments