vendor/assets/javascripts/angular-sanitize.js in angularjs-rails-1.5.0 vs vendor/assets/javascripts/angular-sanitize.js in angularjs-rails-1.5.5
- old
+ new
@@ -1,11 +1,11 @@
/**
- * @license AngularJS v1.5.0
+ * @license AngularJS v1.5.5
* (c) 2010-2016 Google, Inc. http://angularjs.org
* License: MIT
*/
-(function(window, angular, undefined) {'use strict';
+(function(window, angular) {'use strict';
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* Any commits to this file should be reviewed with security in mind. *
* Changes to this file can potentially create security vulnerabilities. *
* An approval from 2 Core members with history of modifying *
@@ -347,11 +347,11 @@
throw $sanitizeMinErr('uinput', "Failed to sanitize html because the input is unstable");
}
mXSSAttempts--;
// strip custom-namespaced attributes on IE<=11
- if (document.documentMode <= 11) {
+ if (window.document.documentMode) {
stripCustomNsAttrs(inertBodyElement);
}
html = inertBodyElement.innerHTML; //trigger mXSS
inertBodyElement.innerHTML = html;
} while (html !== inertBodyElement.innerHTML);
@@ -487,10 +487,10 @@
* to allow any of these custom attributes. This method strips them all.
*
* @param node Root element to process
*/
function stripCustomNsAttrs(node) {
- if (node.nodeType === Node.ELEMENT_NODE) {
+ if (node.nodeType === window.Node.ELEMENT_NODE) {
var attrs = node.attributes;
for (var i = 0, l = attrs.length; i < l; i++) {
var attrNode = attrs[i];
var attrName = attrNode.name.toLowerCase();
if (attrName === 'xmlns:ns1' || attrName.indexOf('ns1:') === 0) {