feat(security): Add an HTML sanitizer#8453
Conversation
4b96dd8 to
d873286
Compare
There was a problem hiding this comment.
there are many more tests at https://github.com/angular/angular.js/blob/master/test/ngSanitize/sanitizeSpec.js did you intentionally port only a few?
There was a problem hiding this comment.
This is intentional.
Most of the tests in the sanitize spec assert that the parser behaves in a particular way, but this code doesn't actually implement a parser. Effectively we're testing the DOM parser. I presume this was done because ngSanitize at some point implemented its own parser, but it doesn't apply to this code.
7f2d5aa to
1849927
Compare
d65ad8c to
c37debd
Compare
|
LGTM in https://reviews.angular.io/D108 from @koto. |
This is based on Angular 1's implementation, parsing an HTML document into an inert DOM Document implementation, and then serializing only specifically whitelisted elements. It currently does not support SVG sanitization, all SVG elements are rejected. If available, the sanitizer uses the `<template>` HTML element as an inert container. Sanitization works client and server-side. Reviewers: rjamet, tbosch , molnarg , koto Differential Revision: https://reviews.angular.io/D108
|
This issue has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
No description provided.