fix(compiler): strip <script> tag from templates

Fixes #2766 Closes #3486
2015-08-05 16:35:59 +02:00
parent 339071cb07
commit 748c2d6c97
3 changed files with 39 additions and 2 deletions
@@ -1130,6 +1130,22 @@ export function main() {
         }));
    });

+    describe("corner cases", () => {
+      it('should remove script tags from templates',
+         inject([TestComponentBuilder, AsyncTestCompleter], (tcb: TestComponentBuilder, async) => {
+           tcb.overrideView(MyComp, new viewAnn.View({
+                template: `
+            <script>alert("Ooops");</script>
+            <div>before<script>alert("Ooops");</script><span>inside</span>after</div>`
+              }))
+               .createAsync(MyComp)
+               .then((rootTC) => {
+                 expect(DOM.querySelectorAll(rootTC.nativeElement, 'script').length).toEqual(0);
+                 async.done();
+               });
+         }));
+    });
+
    describe("error handling", () => {
      it('should report a meaningful error when a directive is missing annotation',
         inject([TestComponentBuilder, AsyncTestCompleter], (tcb: TestComponentBuilder, async) => {