commit ff98f43b24130b9a0b85dc95e67855e142fab397
author Hermann Loose <hermannloose@google.com> Tue Mar 30 15:26:25 2021 +0200
committer Hermann Loose <hermannloose@google.com> Tue Mar 30 16:00:00 2021 +0200
tree cf52016e9f06ae0e7e866d92ae84eb7e82bcb163
parent d3c729cc8b54e127e1ee52cd07eda4d96ae2928f

Ensure image diff data URLs are accepted by goog.html.SafeUrl

While browsers seem to be lenient about a space between MIME type and
data, goog.html.SafeUrl and possibly other sanitizers will not consider
this a valid data URL when checking templates for XSS vulnerabilities.

Change-Id: I0ad43c371fbcdaf9ef348550a3f80eb6ee3fcbfe

polygerrit-ui/app/elements/diff/gr-diff-host/gr-diff-host_test.js

diff --git a/polygerrit-ui/app/elements/diff/gr-diff-host/gr-diff-host_test.js b/polygerrit-ui/app/elements/diff/gr-diff-host/gr-diff-host_test.js
index d31d934..5e1b5ff 100644
--- a/polygerrit-ui/app/elements/diff/gr-diff-host/gr-diff-host_test.js
+++ b/polygerrit-ui/app/elements/diff/gr-diff-host/gr-diff-host_test.js
@@ -404,7 +404,7 @@
         leftImage.addEventListener('load', () => {
           assert.isOk(leftImage);
           assert.equal(leftImage.getAttribute('src'),
-              'data:image/bmp;base64, ' + mockFile1.body);
+              'data:image/bmp;base64,' + mockFile1.body);
           assert.equal(leftLabelContent.textContent, '1×1 image/bmp');
           leftLoaded = true;
           if (rightLoaded) {
@@ -416,7 +416,7 @@
         rightImage.addEventListener('load', () => {
           assert.isOk(rightImage);
           assert.equal(rightImage.getAttribute('src'),
-              'data:image/bmp;base64, ' + mockFile2.body);
+              'data:image/bmp;base64,' + mockFile2.body);
           assert.equal(rightLabelContent.textContent, '1×1 image/bmp');
 
           rightLoaded = true;
@@ -495,7 +495,7 @@
         leftImage.addEventListener('load', () => {
           assert.isOk(leftImage);
           assert.equal(leftImage.getAttribute('src'),
-              'data:image/bmp;base64, ' + mockFile1.body);
+              'data:image/bmp;base64,' + mockFile1.body);
           assert.equal(leftLabelContent.textContent, '1×1 image/bmp');
           leftLoaded = true;
           if (rightLoaded) {
@@ -507,7 +507,7 @@
         rightImage.addEventListener('load', () => {
           assert.isOk(rightImage);
           assert.equal(rightImage.getAttribute('src'),
-              'data:image/bmp;base64, ' + mockFile2.body);
+              'data:image/bmp;base64,' + mockFile2.body);
           assert.equal(rightLabelContent.textContent, '1×1 image/bmp');
 
           rightLoaded = true;