Sanitize innert document #12524

IgorMinar · 2015-08-07T19:41:01Z

No description provided.

googlebot · 2015-08-07T19:41:02Z

We found a Contributor License Agreement for you (the sender of this pull request) and all commit authors, but as best as we can tell these commits were authored by someone else. If that's the case, please add them to this pull request and have them confirm that they're okay with these commits being contributed to Google. If we're mistaken and you did author these commits, just reply here to confirm.

IgorMinar · 2015-08-07T22:50:59Z

hmm.. tests are failing because different browsers enumerate over the list of tags in a different order which results in non-deterministic. I'll either have to sort the attribute list or change the matcher to account for this.

lgalfaso · 2015-08-08T08:51:55Z

@IgorMinar even after sorting the attributes, there are two test failures with IE9

IE 9.0.0 (Windows 7) HTML htmlParser should throw badparse if text content contains "<" followed by an ASCII letter without matching ">" FAILED
    Expected { tag : 'a', attrs : { body : '', bar< : '' } } to equal undefined.
IE 9.0.0 (Windows 7) HTML htmlParser should parse empty value attribute of node FAILED
    Expected null to equal { tag : 'option', attrs : { selected : '', value : '' } }.

I think it should be possible to fix the second issue with something like https://github.com/angular/angular.js/blob/master/src/jqLite.js#L159
The first issue, I am not sure on how to work around it

gkalpak · 2015-08-17T06:28:12Z

src/ngSanitize/sanitize.js

+   * Enables a subset of svg to be supported by the sanitizer.
+   *
+   * **Warning**: By enabling this setting without taking other precautions, you might expose your
+   * application to click-hijacking attacks. In these attacks, a sanitize svg could be positioned


sanitize svg ??

Closes angular#12524 (cherry picked from commit f33ce17)

Closes angular#12524 (manually apply from the commit f33ce17)

Closes angular#12524 (cherry picked from commit f33ce17)

fix($compile): properly sanitize xlink:href attribute interoplation Closes angular#12524 (cherry picked from commit f33ce17) Co-authored-by: Igor Minar <igor@angularjs.org> Co-authored-by: Dumitru Corini <dumitru.corini@gmail.com>

fix: grunt package is working fix(angular.merge): do not merge __proto__ property Report from * angular@c0498d4 * angular@add78e6 fix($compile): properly sanitize xlink:href attribute interoplation Closes angular#12524 (cherry picked from commit f33ce17) Build version on windows Build version on windows Update ReadMe for Windows environment Update ReadMe Fix Unit Test Fix Unit Test Fix Unit Test Fix Test e2e Fix Test e2e Fix Test e2e Fix Test e2e

fix: grunt package is working fix(angular.merge): do not merge __proto__ property Report from * angular@c0498d4 * angular@add78e6 fix($compile): properly sanitize xlink:href attribute interoplation Closes angular#12524 (cherry picked from commit f33ce17) Build version on windows Build version on windows Update ReadMe for Windows environment Update ReadMe Fix Unit Test Fix Unit Test Fix Unit Test Fix Test e2e Fix Test e2e Fix Test e2e Fix Test e2e Fix npm:angular:20150909 Test and Validation CVE npm:angular:20150909 fix($sanitize): disallow unsafe svg animation tags and add mXSS protection

googlebot added the cla: no label Aug 7, 2015

IgorMinar mentioned this pull request Aug 7, 2015

chore(sanitize): new implementation of the html sanitized parser #11790

Closed

IgorMinar added cla: yes and removed cla: no labels Aug 7, 2015

lgalfaso mentioned this pull request Aug 9, 2015

fix(sanitize): Do not duplicate self closing elements #12477

Closed

IgorMinar force-pushed the sanitize-innertDocument branch from e403d80 to f128934 Compare August 11, 2015 22:05

googlebot added cla: no and removed cla: yes labels Aug 11, 2015

IgorMinar added cla: yes and removed cla: no labels Aug 11, 2015

IgorMinar force-pushed the sanitize-innertDocument branch from f128934 to d99fb5a Compare August 11, 2015 22:06

googlebot added cla: no and removed cla: yes labels Aug 11, 2015

IgorMinar force-pushed the sanitize-innertDocument branch 5 times, most recently from 1520d90 to d24463f Compare August 12, 2015 14:10

gkalpak reviewed Aug 17, 2015
View reviewed changes

petebacondarwin mentioned this pull request Sep 7, 2015

feat(ngSanitize): add $sanitizeExt factory #6252

Closed

IgorMinar force-pushed the sanitize-innertDocument branch 6 times, most recently from 4d3a2a4 to 801fb7a Compare September 10, 2015 00:02

mend-bolt-for-github bot mentioned this pull request Dec 30, 2021

CVE-2019-14863 (Medium) detected in angular-1.2.16.js, angular-1.2.16.min.js developerone12/WebGoat-WhiteSource-Bolt#79

Open

mend-bolt-for-github bot mentioned this pull request Feb 19, 2022

angular-1.4.2.min.js: 7 vulnerabilities (highest severity is: 7.5) talmax1124/creativeduoshopping-master#133

Open

This was referenced Mar 23, 2022

angular-1.2.16.min.js: 7 vulnerabilities (highest severity is: 7.5) hasiMoto1/WebGoat-WhiteSource-Bolt#2

Open

angular-1.2.16.js: 7 vulnerabilities (highest severity is: 7.5) hasiMoto1/WebGoat-WhiteSource-Bolt#17

Open

This was referenced May 4, 2022

angular-1.2.16.min.js: 7 vulnerabilities (highest severity is: 7.5) testdemo1227/Demo-WebGoat1#2

Open

angular-1.2.16.js: 7 vulnerabilities (highest severity is: 7.5) testdemo1227/Demo-WebGoat1#17

Open

benjaminParisel pushed a commit to bonitasoft/angular.js that referenced this pull request Jan 24, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

f6ba1ef

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege added a commit to bonitasoft/angular.js that referenced this pull request Feb 6, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

017a7d1

Closes angular#12524 (manually apply from the commit f33ce17)

julienmege mentioned this pull request Feb 6, 2023

fix($compile): properly sanitize xlink:href attribute interpolation bonitasoft/angular.js#2

Merged

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 6, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

7edb598

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 20, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

388d346

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 20, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

7549b65

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 20, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

6940647

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 20, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

9b3c9ce

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 21, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

28daa39

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 21, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

0a641ef

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 21, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

921709a

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 21, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

98a1ebc

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 21, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

c8c0212

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 21, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

feefcd1

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 24, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

647469c

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 24, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

f5bc28e

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 24, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

145d8dc

Closes angular#12524 (cherry picked from commit f33ce17)

julienmege pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 24, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

0676a62

Closes angular#12524 (cherry picked from commit f33ce17)

DumitruCorini pushed a commit to bonitasoft/angular.js that referenced this pull request Feb 24, 2023

fix($compile): properly sanitize xlink:href attribute interoplation

2c08c4f

Closes angular#12524 (cherry picked from commit f33ce17)

taki-eddine-rahal mentioned this pull request Mar 3, 2023

fix($sanitize): disallow unsafe svg animation tags and add mXSS prote… bonitasoft/angular.js#16

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sanitize innert document #12524

Sanitize innert document #12524

IgorMinar commented Aug 7, 2015

googlebot commented Aug 7, 2015

IgorMinar commented Aug 7, 2015

lgalfaso commented Aug 8, 2015

gkalpak Aug 17, 2015

IgorMinar Sep 8, 2015

Sanitize innert document #12524

Sanitize innert document #12524

Conversation

IgorMinar commented Aug 7, 2015

googlebot commented Aug 7, 2015

IgorMinar commented Aug 7, 2015

lgalfaso commented Aug 8, 2015

gkalpak Aug 17, 2015

Choose a reason for hiding this comment

IgorMinar Sep 8, 2015

Choose a reason for hiding this comment