fix(linky): encode double quotes when serializing email addresses

lgalfaso · petebacondarwin · commit 8ee8ffeba0a5 · 2014-11-23T21:58:18.000Z
Email addresses can (under certain restrictions) include double quote characters. See http://tools.ietf.org/html/rfc3696#section-3. For example, `"Jo Bloggs"@abc.com` is a valid email address. When serializing emails to the `href` attribute of an anchor element, we must HTML encode these double quote characters. See http://www.w3.org/TR/html-markup/syntax.html#syntax-attr-double-quoted This commit does not attempt to improve the functionality (i.e. regex) that attempts to identify email addresses in a general string. Closes angular#8945 Closes angular#8964 Closes angular#5946 Closes angular#10090 Closes angular#9256
diff --git a/src/ngSanitize/filter/linky.js b/src/ngSanitize/filter/linky.js
@@ -142,7 +142,7 @@ angular.module('ngSanitize').filter('linky', ['$sanitize', function($sanitize) {
                   '" ');
       }
       html.push('href="',
-                url,
+                url.replace('"', '&quot;'),
                 '">');
       addText(text);
       html.push('</a>');
diff --git a/test/ngSanitize/filter/linkySpec.js b/test/ngSanitize/filter/linkySpec.js
@@ -29,6 +29,10 @@ describe('linky', function() {
       toEqual('my email is &#34;<a href="mailto:me@example.com">me@example.com</a>&#34;');
   });
 
+  it('should handle quotes in the email', function() {
+    expect(linky('foo@"bar.com')).toEqual('<a href="mailto:foo@&#34;bar.com">foo@&#34;bar.com</a>');
+  });
+
   it('should handle target:', function() {
     expect(linky("http://example.com", "_blank")).
       toEqual('<a target="_blank" href="http://example.com">http://example.com</a>');

Original file line number	Diff line number	Diff line change
`@@ -142,7 +142,7 @@ angular.module('ngSanitize').filter('linky', ['$sanitize', function($sanitize) {`
`142`	`142`	`'" ');`
`143`	`143`	`}`
`144`	`144`	`html.push('href="',`
`145`		`- url,`
	`145`	`+ url.replace('"', '"'),`
`146`	`146`	`'">');`
`147`	`147`	`addText(text);`
`148`	`148`	`html.push('</a>');`