2

I use AntiXss Encoder on serverside for XSS atacks so all response includes html unescape characters like "&lt:script&gt:alert(1);&lt:/script&gt:" (replaced ';' as ':')

on binding i use sanitize with ng-bind-html there is no problem wih that. There is an other control input for update mode. When user needs to update text they click update icon then i show textarea and hide binded tag with ng-if. textarea has ng-model attr. i cant escape html characters on textarea like ng-bind-html here is the snippet pls help im getting creazy..

in fiddle; edit mode textarea must display "<script>alert(1);</script>" with no alert action and data will be sent to the server must display same too...

here is the fiddle

var app = angular.module('myApp',['ngSanitize']);

app.controller('MyCtrl', function($scope, $sce, $sanitize) {
    $scope.post1 = "&lt;script&gt;alert(1);&lt;/script&gt;";
    //$scope.post2 = $sce.parseAsHtml("<h1>alert(1)</h1>");
    $scope.logs = ["log created"];
    $scope.log = function(val){
     $scope.logs.push(val);
    }
});
.label {
  text-decoration:underline;
  color:red;
}
<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.4.8/angular.min.js"></script>
<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.4.8/angular-sanitize.min.js"></script>

<div ng-app="myApp">
  <div ng-controller="MyCtrl">
      <div class="label">Edit mode :</div>
      <textarea ng-model="post1" style="width:100%;" rows="5"></textarea><br />
      <div class="label">Binding mode :</div>
      <div ng-bind-html="post1"></div><br />
      <div class="label">Data will be send to the server :</div>
      <div>{{post1}}</div><br />
      <div class="label">Logs (if needed) :</div>
      <div ng-repeat="d in logs">
        <p>{{($index+1) + ". " + d}}</p>
      </div>
</div>
</div>
Unsal Aslan
  • 101
  • 1
  • 5

0 Answers0