You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat($compile): add support for arbitrary DOM property and event bindings
Properties:
Previously only arbitrary DOM attribute bindings were supported via interpolation such as
`my-attribute="{{expression}}"` or `ng-attr-my-attribute="{{expression}}"`, and only a set of
distinct properties could be bound. `ng-prop-*` adds support for binding expressions to any DOM
properties. For example `ng-prop-foo="x"` will assign the value of the expression `x` to the
`foo` property, and re-assign whenever the expression `x` changes.
Events:
Previously only a distinct set of DOM events could be bound using directives such as `ng-click`,
`ng-blur` etc. `ng-on-*` adds support for binding expressions to any DOM event. For example
`ng-on-bar="barOccured($event)"` will add a listener to the "bar" event and invoke the
`barOccured($event)` expression.
Since HTML attributes are case-insensitive, property and event names are specified in snake_case
for `ng-prop-*` and `ng-on-*`. For example, to bind property `fooBar` use `ng-prop-foo_bar`, to
listen to event `fooBar` use `ng-on-foo_bar`.
Fixesangular#16428Fixesangular#16235Closesangular#16614
This error occurs when the security context for a property is defined via {@link ng.$compileProvider#addPropertySecurityContext addPropertySecurityContext()} multiple times under different security contexts.
This error occurs when one tries to create a binding for event handler attributes like `onclick`, `onload`, `onsubmit`, etc.
6
+
This error occurs when one tries to create a binding for event handler attributes or properties like `onclick`, `onload`, `onsubmit`, etc.
7
7
8
-
There is no practical value in binding to these attributes and doing so only exposes your application to security vulnerabilities like XSS.
9
-
For these reasons binding to event handler attributes (all attributes that start with `on` and `formaction` attribute) is not supported.
8
+
There is no practical value in binding to these attributes/properties and doing so only exposes your application to security vulnerabilities like XSS.
9
+
For these reasons binding to event handler attributes and properties (`formaction` and all starting with `on`) is not supported.
10
10
11
11
12
12
An example code that would allow XSS vulnerability by evaluating user input in the window context could look like this:
@@ -17,4 +17,4 @@ An example code that would allow XSS vulnerability by evaluating user input in t
17
17
18
18
Since the `onclick` evaluates the value as JavaScript code in the window context, setting the `username` model to a value like `javascript:alert('PWND')` would result in script injection when the `div` is clicked.
19
19
20
-
20
+
Please use the `ng-*` or `ng-on-*` versions instead (such as `ng-click` or `ng-on-click` rather than `onclick`).
throw$compileMinErr('ctxoverride','Property context \'{0}.{1}\' already set to \'{2}\', cannot override to \'{3}\'.',elementName,propertyName,PROP_CONTEXTS[key],ctx);
1613
+
}
1614
+
1615
+
PROP_CONTEXTS[key]=ctx;
1616
+
returnthis;
1617
+
};
1618
+
1619
+
/* Default property contexts.
1620
+
*
1621
+
* Copy of https://github.com/angular/angular/blob/6.0.6/packages/compiler/src/schema/dom_security_schema.ts#L31-L58
1622
+
* Changing:
1623
+
* - SecurityContext.* => SCE_CONTEXTS/$sce.*
1624
+
* - STYLE => CSS
1625
+
* - various URL => MEDIA_URL
1626
+
* - *|formAction, form|action URL => RESOURCE_URL (like the attribute)
0 commit comments