diff --git a/.gitignore b/.gitignore index b365a67ad8..4be3d3a2b1 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ node_modules ignored -.idea \ No newline at end of file +.idea +.DS_Store diff --git a/docs/index.md b/docs/index.md index caaffc62d9..f649cad58d 100644 --- a/docs/index.md +++ b/docs/index.md @@ -53,7 +53,7 @@ sequenceDiagram -Play with mermaid using this [editor](http://danielmschmidt.github.io/mermaid-demo/). You can also look at mermaid in action using [jsbin](http://jsbin.com/faxunexeku/1/edit?html,output). +Play with mermaid using this [editor](http://danielmschmidt.github.io/mermaid-demo/) or this [live editor](live_editor). You can also look at mermaid in action using [jsbin](http://jsbin.com/faxunexeku/1/edit?html,output). ## Further reading diff --git a/index.html b/index.html index 00820b6e20..a0db85ca24 100644 --- a/index.html +++ b/index.html @@ -229,7 +229,7 @@
Play with mermaid using this editor. You can also look at mermaid in action using jsbin.
+Play with mermaid using this editor or this live editor. You can also look at mermaid in action using jsbin.
Request expectations | Backend definitions | |
---|---|---|
Syntax | + *.expect(...).respond(...) | + *.when(...).respond(...) | + *
Typical usage | + *strict unit tests | + *loose (black-box) unit testing | + *
Fulfills multiple requests | + *NO | + *YES | + *
Order of requests matters | + *YES | + *NO | + *
Request required | + *YES | + *NO | + *
Response required | + *optional (see below) | + *YES | + *
Directive | +How | +Source | +Rendered | +
ng-bind-html | +Automatically uses $sanitize | +<div ng-bind-html="snippet"> |
+ + |
ng-bind-html | +Bypass $sanitize by explicitly trusting the dangerous value | +
+ <div ng-bind-html="deliberatelyTrustDangerousSnippet()"> +</div>+ |
+ + |
ng-bind | +Automatically escapes | +<div ng-bind="snippet"> |
+ + |
an html\nclick here\nsnippet
'); + }); + + it('should inline raw snippet if bound to a trusted value', function() { + expect(element(by.css('#bind-html-with-trust div')).getInnerHtml()). + toBe("an html\n" + + "click here\n" + + "snippet
"); + }); + + it('should escape snippet without any filter', function() { + expect(element(by.css('#bind-default div')).getInnerHtml()). + toBe("<p style=\"color:blue\">an html\n" + + "<em onmouseover=\"this.textContent='PWN3D!'\">click here</em>\n" + + "snippet</p>"); + }); + + it('should update', function() { + element(by.model('snippet')).clear(); + element(by.model('snippet')).sendKeys('new text'); + expect(element(by.css('#bind-html-with-sanitize div')).getInnerHtml()). + toBe('new text'); + expect(element(by.css('#bind-html-with-trust div')).getInnerHtml()).toBe( + 'new text'); + expect(element(by.css('#bind-default div')).getInnerHtml()).toBe( + "new <b onclick=\"alert(1)\">text</b>"); + }); +Filter | +Source | +Rendered | +
linky filter | +
+ <div ng-bind-html="snippet | linky">+ |
+ + + | +
linky target | +
+ <div ng-bind-html="snippetWithTarget | linky:'_blank'">+ |
+ + + | +
no filter | +<div ng-bind="snippet"> |
+ + |
t |