AngularJs How to sanitize URL in the controller?

Question

I was wondering if there is a programmatic way of sanitizing (user provided) URLs in AngularJs 1.5. I know there is $sanitize service, which is for sanitizing HTML but I can't find something that would work for URL.

Sample Good URL:

http://www.somedomain.com

Sample Dangerous URL:

javascript:document.write('Time for some fun');

What exactly do you want to use urls for? Try to bind a dangerous url to href and see what happens. — Estus Flask, Aug 25 '17 at 17:41
When I bind it to an element and try to click on the element, then URL is automatically sanitized by Angular and I basically end up on a new tab. But in my case, I need to sanitize the URL programmatically. — Parth Shah, Aug 25 '17 at 17:56

score 0 · Answer 1 · answered Aug 25 '17 at 17:55

0

There is undocumented $$sanitizeUri service that does this. It's basically a function that adds unsafe prefix to supplied URL. There's no need to use it for URLs are bound to href like

<a href="{{url}}">

because this is already done by compiler ($$sanitizeUri is used there).

For malformed URLs in general it may be better to process them by hand and possibly add http:// if it doesn't contain acceptable (http/https) protocol.

answered Aug 25 '17 at 17:55

Estus Flask

206,104
70
425
565

Thank you for your answer. However I don't want to create a element just so I can use the $$sanitizeUri service. Your answer did help me with the js code I can use to test for dangerous URLs, so thanks! – Parth Shah Aug 25 '17 at 19:11

score 0 · Answer 2 · answered Aug 28 '17 at 18:51

I ended up performing the following regex test (inspired from $$sanitizeUri service) on the URLs and then performing a special operation whenever the check failed.

function navigateToUrl(url) {
    var safeWhiteListRegex = \^(https?|ftps?|file?):\/\/\gi;
    if (!safeWhiteListRegex.test(url)) {
        // url = ...;
    } else {
        $window.open(url, "_blank");
    }
}

Along the way, one of my friends also discovered the @braintree/sanitize-url Node Module, which I also think is something people can use for situations like this.

AngularJs How to sanitize URL in the controller?

2 Answers2