Skip to content
This repository has been archived by the owner on Apr 12, 2024. It is now read-only.

fix($compile): secure form[action] & iframe[srcdoc] #4933

Closed
wants to merge 1 commit into from

Conversation

chirayuk
Copy link
Contributor

Require bindings to form[action] to be $sce.RESOURCE_URL and bindings to
iframe[srcdoc] to be $sce.HTML

Closes #4927

@ghost ghost assigned vojtajina Nov 13, 2013
Require bindings to form[action] to be $sce.RESOURCE_URL and bindings to
iframe[srcdoc] to be $sce.HTML

Closes angular#4927
$rootScope.html = '<div onclick="">hello</div>';
expect(function() { $rootScope.$digest(); }).toThrowMinErr('$interpolate', 'interr', new RegExp(
/Can't interpolate: {{html}}\n/.source +
/[^[]*\[\$sce:unsafe\] Attempting to use an unsafe value in a safe context./.source));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the error message should read ".... in sensitive context" not "safe context"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged.  Changing this requires also changing about 10 other places (in sce.js and sceSpecs.js) so let's do that in a separate commit.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

@chirayuk chirayuk closed this in 0421cb4 Nov 22, 2013
jamesdaily pushed a commit to jamesdaily/angular.js that referenced this pull request Jan 27, 2014
Require bindings to form[action] to be $sce.RESOURCE_URL and bindings to
iframe[srcdoc] to be $sce.HTML

Closes angular#4927
Closes angular#4933
jamesdaily pushed a commit to jamesdaily/angular.js that referenced this pull request Jan 27, 2014
Require bindings to form[action] to be $sce.RESOURCE_URL and bindings to
iframe[srcdoc] to be $sce.HTML

Closes angular#4927
Closes angular#4933
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

ng-attr-action and ng-attr-srcdoc allow binding to Javascript
3 participants