From c2a37bffd2e446ad7f86730518cf7aee60b52c27 Mon Sep 17 00:00:00 2001 From: Anders Hessellund Jensen Date: Mon, 6 May 2013 22:18:42 +0200 Subject: [PATCH] fix($compile) empty href should pass sanitation check The htmlAnchorDirective sets an empty href attribute on tags. This should pass sanitation check in $compile. Closes #2219 --- src/ng/compile.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ng/compile.js b/src/ng/compile.js index ac8d13ceb8a5..2dd2c30489f1 100644 --- a/src/ng/compile.js +++ b/src/ng/compile.js @@ -293,7 +293,7 @@ function $CompileProvider($provide) { // href property always returns normalized absolute url, so we can match against that normalizedVal = urlSanitizationNode.href; - if (!normalizedVal.match(urlSanitizationWhitelist)) { + if (normalizedVal !== '' && !normalizedVal.match(urlSanitizationWhitelist)) { this[key] = value = 'unsafe:' + normalizedVal; } }