diff --git a/src/ng/compile.js b/src/ng/compile.js index d85af28c6eba..91844f45e358 100644 --- a/src/ng/compile.js +++ b/src/ng/compile.js @@ -155,6 +155,10 @@ function $CompileProvider($provide) { CLASS_DIRECTIVE_REGEXP = /(([\d\w\-_]+)(?:\:([^;]+))?;?)/, urlSanitizationWhitelist = /^\s*(https?|ftp|mailto|file):/; + // Ref: http://developers.whatwg.org/webappapis.html#event-handler-idl-attributes + // The assumption is that future DOM event attribute names will begin with + // 'on' and be composed of only English letters. + var EVENT_HANDLER_ATTR_REGEXP = /^(on[a-z]*|formaction)$/; /** * @ngdoc function @@ -1165,6 +1169,12 @@ function $CompileProvider($provide) { compile: valueFn(function attrInterpolateLinkFn(scope, element, attr) { var $$observers = (attr.$$observers || (attr.$$observers = {})); + if (EVENT_HANDLER_ATTR_REGEXP.test(name)) { + throw $compileMinErr('nodomevents', + "Interpolations for HTML DOM event attributes are disallowed. Please use the ng- " + + "versions (such as ng-click instead of onclick) instead."); + } + // we need to interpolate again, in case the attribute value has been updated // (e.g. by another directive's compile function) interpolateFn = $interpolate(attr[name], true); diff --git a/test/ng/compileSpec.js b/test/ng/compileSpec.js index b713476b8753..672a704d1154 100755 --- a/test/ng/compileSpec.js +++ b/test/ng/compileSpec.js @@ -2831,6 +2831,36 @@ describe('$compile', function() { }); }); + describe('interpolation on HTML DOM event handler attributes onclick, onXYZ, formaction', function() { + it('should disallow interpolation on onclick', inject(function($compile, $rootScope) { + // All interpolations are disallowed. + $rootScope.onClickJs = ""; + expect(function() { + $compile('