Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

Commit b80eca8

Browse files
petebacondarwinpetebacondarwin
committed
SQUASH: rename SRC to MEDIA_URL 
1 parent a2124a8 commit b80eca8

File tree

6 files changed

+30
-30
lines changed

6 files changed

+30
-30
lines changed

‎docs/content/error/$compile/srcset.ngdoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
This error occurs if you try to programmatically set the `srcset` attribute with a non-string value.
77

88
This can be the case if you tried to avoid the automatic sanitization of the `srcset` value by
9-
passing a "trusted" value provided by calls to `$sce.trustAsSrc(value)`.
9+
passing a "trusted" value provided by calls to `$sce.trustAsMediaUrl(value)`.
1010

1111
If you want to programmatically set explicitly trusted unsafe URLs, you should use `$sce.trustAsHtml`
1212
on the whole `img` tag and inject it into the DOM using the `ng-bind-html` directive.

‎src/ng/compile.js

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1719,7 +1719,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
17191719
// Such values are a bit too complex to handle automatically inside $sce.
17201720
// Instead, we sanitize each of the URIs individually, which works, even dynamically.
17211721

1722-
// It's not possible to work around this using `$sce.trustAsSrc`.
1722+
// It's not possible to work around this using `$sce.trustAsMediaUrl`.
17231723
// If you want to programmatically set explicitly trusted unsafe URLs, you should use
17241724
// `$sce.trustAsHtml` on the whole `img` tag and inject it into the DOM using the
17251725
// `ng-bind-html` directive.
@@ -1740,7 +1740,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
17401740
for (var i = 0; i < nbrUrisWith2parts; i++) {
17411741
var innerIdx = i * 2;
17421742
// sanitize the uri
1743-
result += $sce.getTrustedSrc(trim(rawUris[innerIdx]));
1743+
result += $sce.getTrustedMediaUrl(trim(rawUris[innerIdx]));
17441744
// add the descriptor
17451745
result += ' ' + trim(rawUris[innerIdx + 1]);
17461746
}
@@ -1749,7 +1749,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
17491749
var lastTuple = trim(rawUris[i * 2]).split(/\s/);
17501750

17511751
// sanitize the last uri
1752-
result += $sce.getTrustedSrc(trim(lastTuple[0]));
1752+
result += $sce.getTrustedMediaUrl(trim(lastTuple[0]));
17531753

17541754
// and add the last descriptor if any
17551755
if (lastTuple.length === 2) {
@@ -3275,15 +3275,15 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
32753275
}
32763276
var tag = nodeName_(node);
32773277
// All tags with src attributes require a RESOURCE_URL value, except for
3278-
// img and various html5 media tags, which require the SRC context.
3278+
// img and various html5 media tags, which require the MEDIA_URL context.
32793279
if (attrNormalizedName === 'src' || attrNormalizedName === 'ngSrc') {
32803280
if (['img', 'video', 'audio', 'source', 'track'].indexOf(tag) === -1) {
32813281
return $sce.RESOURCE_URL;
32823282
}
3283-
return $sce.SRC;
3283+
return $sce.MEDIA_URL;
32843284
} else if (attrNormalizedName === 'xlinkHref') {
32853285
// Some xlink:href are okay, most aren't
3286-
if (tag === 'image') return $sce.SRC;
3286+
if (tag === 'image') return $sce.MEDIA_URL;
32873287
if (tag === 'a') return $sce.URL;
32883288
return $sce.RESOURCE_URL;
32893289
} else if (

‎src/ng/interpolate.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ function $InterpolateProvider() {
120120
}
121121

122122
function isConcatenationAllowed(context) {
123-
return context === $sce.URL || context === $sce.SRC;
123+
return context === $sce.URL || context === $sce.MEDIA_URL;
124124
}
125125

126126
/**
@@ -300,7 +300,7 @@ function $InterpolateProvider() {
300300
// that is more testable or make it obvious that you bound the value to some user controlled
301301
// value. This helps reduce the load when auditing for XSS issues.
302302

303-
// Note that URL and SRC $sce contexts do not need this, since `$sce` can sanitize the values
303+
// Note that URL and MEDIA_URL $sce contexts do not need this, since `$sce` can sanitize the values
304304
// passed to it. In that case, `$sce.getTrusted` will be called on either the single expression
305305
// or on the overall concatenated string (losing trusted types used in the mix, by design).
306306
// Both these methods will sanitize plain strings. Also, HTML could be included, but since it's

‎src/ng/sce.js

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ var SCE_CONTEXTS = {
2323
CSS: 'css',
2424

2525
// An URL used in a context where it refers to the source of media such as an image, audio, video, etc.
26-
SRC: 'src',
26+
MEDIA_URL: 'mediaUrl',
2727

2828
// An URL used in a context where it does not refer to a resource that loads code, this is a superset of
2929
// urls that can be used as a source for media.
@@ -310,8 +310,8 @@ function $SceDelegateProvider() {
310310

311311
byType[SCE_CONTEXTS.HTML] = generateHolderType(trustedValueHolderBase);
312312
byType[SCE_CONTEXTS.CSS] = generateHolderType(trustedValueHolderBase);
313-
byType[SCE_CONTEXTS.SRC] = generateHolderType(trustedValueHolderBase);
314-
byType[SCE_CONTEXTS.URL] = generateHolderType(byType[SCE_CONTEXTS.SRC]);
313+
byType[SCE_CONTEXTS.MEDIA_URL] = generateHolderType(trustedValueHolderBase);
314+
byType[SCE_CONTEXTS.URL] = generateHolderType(byType[SCE_CONTEXTS.MEDIA_URL]);
315315
byType[SCE_CONTEXTS.JS] = generateHolderType(trustedValueHolderBase);
316316
byType[SCE_CONTEXTS.RESOURCE_URL] = generateHolderType(byType[SCE_CONTEXTS.URL]);
317317

@@ -396,7 +396,7 @@ function $SceDelegateProvider() {
396396
* `$sceDelegate.trustAs`} result), or it might try to sanitize the value given, depending on
397397
* the context and sanitizer availablility.
398398
*
399-
* The contexts that can be sanitized are $sce.SRC, $sce.URL and $sce.HTML. The first two are available
399+
* The contexts that can be sanitized are $sce.MEDIA_URL, $sce.URL and $sce.HTML. The first two are available
400400
* by default, and the second one relies on the $sanitize service (which may be loaded through
401401
* the ngSanitize module). Furthermore, for $sce.RESOURCE_URL context, a plain string may be
402402
* accepted if the resource url policy defined by {@link ng.$sceDelegateProvider#resourceUrlWhitelist
@@ -436,7 +436,7 @@ function $SceDelegateProvider() {
436436
}
437437

438438
// If we get here, then we will either sanitize the value or throw an exception.
439-
if (type === SCE_CONTEXTS.SRC) {
439+
if (type === SCE_CONTEXTS.MEDIA_URL) {
440440
return $$sanitizeUri(maybeTrusted, true);
441441
} else if (type === SCE_CONTEXTS.URL) {
442442
return $$sanitizeUri(maybeTrusted);
@@ -620,7 +620,7 @@ function $SceDelegateProvider() {
620620
* |---------------------|----------------|
621621
* | `$sce.HTML` | For HTML that's safe to source into the application. The {@link ng.directive:ngBindHtml ngBindHtml} directive uses this context for bindings. If an unsafe value is encountered and the {@link ngSanitize $sanitize} module is present this will sanitize the value instead of throwing an error. |
622622
* | `$sce.CSS` | For CSS that's safe to source into the application. Currently unused. Feel free to use it in your own directives. |
623-
* | `$sce.SRC` | For URLs that are safe to display as media. Is automatically converted from string by sanitizing when needed. |
623+
* | `$sce.MEDIA_URL` | For URLs that are safe to display as media. Is automatically converted from string by sanitizing when needed. |
624624
* | `$sce.URL` | For URLs that are safe to follow as links. Is automatically converted from string by sanitizing when needed. |
625625
* | `$sce.RESOURCE_URL` | For URLs that are not only safe to follow as links, but whose contents are also safe to include in your application. Examples include `ng-include`, `src` / `ngSrc` bindings for tags other than `IMG` (e.g. `IFRAME`, `OBJECT`, etc.) <br><br>Note that `$sce.RESOURCE_URL` makes a stronger statement about the URL than `$sce.URL` does and therefore contexts requiring values trusted for `$sce.RESOURCE_URL` can be used anywhere that values trusted for `$sce.URL` are required. |
626626
* | `$sce.JS` | For JavaScript that is safe to execute in your application's context. Currently unused. Feel free to use it in your own directives. |
@@ -629,7 +629,7 @@ function $SceDelegateProvider() {
629629
* <div class="alert alert-warning">
630630
* Be aware that `a[href]` and `img[src]` used to automatically sanitize their URLs and not pass them
631631
* through {@link ng.$sce#getTrusted $sce.getTrusted}. **As of 1.7.0, this is no longer the case.**
632-
* Now `getTrusted` will sanitize values for the `$sce.SRC` and `$sce.URL` contexts.
632+
* Now `getTrusted` will sanitize values for the `$sce.MEDIA_URL` and `$sce.URL` contexts.
633633
* </div>
634634
*
635635
* There are no CSS or JS context bindings in AngularJS currently, so their corresponding `$sce.trustAs`

‎test/ng/compileSpec.js

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4236,7 +4236,7 @@ describe('$compile', function() {
42364236
}));
42374237

42384238
it('should not accept trusted values for img[srcset]', inject(function($compile, $rootScope, $sce) {
4239-
var trusted = $sce.trustAsSrc('trustme:foo()');
4239+
var trusted = $sce.trustAsMediaUrl('trustme:foo()');
42404240
element = $compile('<img></img>')($rootScope);
42414241
expect(function() {
42424242
$rootScope.attr.$set('srcset', trusted);
@@ -11096,9 +11096,9 @@ describe('$compile', function() {
1109611096
}));
1109711097

1109811098
it('should accept trusted values', inject(function($rootScope, $compile, $sce) {
11099-
// As a SRC URL
11099+
// As a MEDIA_URL URL
1110011100
element = $compile('<' + tag + ' src="{{testUrl}}"></' + tag + '>')($rootScope);
11101-
$rootScope.testUrl = $sce.trustAsSrc('javascript:foo()');
11101+
$rootScope.testUrl = $sce.trustAsMediaUrl('javascript:foo()');
1110211102
$rootScope.$digest();
1110311103
expect(element.attr('src')).toEqual('javascript:foo()');
1110411104

@@ -11132,9 +11132,9 @@ describe('$compile', function() {
1113211132
}));
1113311133

1113411134
it('should accept trusted values', inject(function($rootScope, $compile, $sce) {
11135-
// As a SRC URL
11135+
// As a MEDIA_URL URL
1113611136
element = $compile('<video><' + tag + ' src="{{testUrl}}"></' + tag + '></video>')($rootScope);
11137-
$rootScope.testUrl = $sce.trustAsSrc('javascript:foo()');
11137+
$rootScope.testUrl = $sce.trustAsMediaUrl('javascript:foo()');
1113811138
$rootScope.$digest();
1113911139
expect(element.find(tag).attr('src')).toEqual('javascript:foo()');
1114011140

@@ -11158,7 +11158,7 @@ describe('$compile', function() {
1115811158

1115911159
it('should accept trusted values', inject(function($rootScope, $compile, $sce) {
1116011160
element = $compile('<img src="{{testUrl}}"></img>')($rootScope);
11161-
$rootScope.testUrl = $sce.trustAsSrc('javascript:foo();');
11161+
$rootScope.testUrl = $sce.trustAsMediaUrl('javascript:foo();');
1116211162
$rootScope.$digest();
1116311163
expect(element.attr('src')).toEqual('javascript:foo();');
1116411164
}));
@@ -11231,7 +11231,7 @@ describe('$compile', function() {
1123111231
element = $compile('<img src="{{testUrl}}"></img>')($rootScope);
1123211232
// Assigning javascript:foo to src makes at least IE9-11 complain, so use another
1123311233
// protocol name.
11234-
$rootScope.testUrl = $sce.trustAsSrc('someUnsafeThing:foo();');
11234+
$rootScope.testUrl = $sce.trustAsMediaUrl('someUnsafeThing:foo();');
1123511235
$rootScope.$apply();
1123611236
expect(element.attr('src')).toEqual('someUnsafeThing:foo();');
1123711237
});

‎test/ng/sceSpecs.js

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -554,21 +554,21 @@ describe('SCE', function() {
554554

555555
describe('URL-context sanitization', function() {
556556
it('should sanitize values that are not whitelisted', inject(function($sce) {
557-
expect($sce.getTrustedSrc('javascript:foo')).toEqual('unsafe:javascript:foo');
557+
expect($sce.getTrustedMediaUrl('javascript:foo')).toEqual('unsafe:javascript:foo');
558558
expect($sce.getTrustedUrl('javascript:foo')).toEqual('unsafe:javascript:foo');
559559
}));
560560

561561
it('should not sanitize values that are whitelisted', inject(function($sce) {
562-
expect($sce.getTrustedSrc('http://example.com')).toEqual('http://example.com');
562+
expect($sce.getTrustedMediaUrl('http://example.com')).toEqual('http://example.com');
563563
expect($sce.getTrustedUrl('http://example.com')).toEqual('http://example.com');
564564
}));
565565

566566
it('should not sanitize trusted values', inject(function($sce) {
567-
expect($sce.getTrustedSrc($sce.trustAsSrc('javascript:foo'))).toEqual('javascript:foo');
568-
expect($sce.getTrustedSrc($sce.trustAsUrl('javascript:foo'))).toEqual('javascript:foo');
569-
expect($sce.getTrustedSrc($sce.trustAsResourceUrl('javascript:foo'))).toEqual('javascript:foo');
567+
expect($sce.getTrustedMediaUrl($sce.trustAsMediaUrl('javascript:foo'))).toEqual('javascript:foo');
568+
expect($sce.getTrustedMediaUrl($sce.trustAsUrl('javascript:foo'))).toEqual('javascript:foo');
569+
expect($sce.getTrustedMediaUrl($sce.trustAsResourceUrl('javascript:foo'))).toEqual('javascript:foo');
570570

571-
expect($sce.getTrustedUrl($sce.trustAsSrc('javascript:foo'))).toEqual('unsafe:javascript:foo');
571+
expect($sce.getTrustedUrl($sce.trustAsMediaUrl('javascript:foo'))).toEqual('unsafe:javascript:foo');
572572
expect($sce.getTrustedUrl($sce.trustAsUrl('javascript:foo'))).toEqual('javascript:foo');
573573
expect($sce.getTrustedUrl($sce.trustAsResourceUrl('javascript:foo'))).toEqual('javascript:foo');
574574
}));
@@ -579,7 +579,7 @@ describe('SCE', function() {
579579
$provide.value('$$sanitizeUri', $$sanitizeUri);
580580
});
581581
inject(function($sce) {
582-
expect($sce.getTrustedSrc('someUrl')).toEqual('someSanitizedUrl');
582+
expect($sce.getTrustedMediaUrl('someUrl')).toEqual('someSanitizedUrl');
583583
expect($$sanitizeUri).toHaveBeenCalledOnceWith('someUrl', true);
584584

585585
$$sanitizeUri.calls.reset();

0 commit comments

Comments
 (0)