Allow Angular XSS Attack











up vote
1
down vote

favorite












I want to create an example of xss attack, with angular 7, for teaching purposes.



<div class="container mt-3">
<div class="row">
<div class="col-12">
<ul>
<li *ngFor="let message of messages">{{message}}</li>
<li *ngFor="let message of messages" [innerHTML]="message"></li>
<li *ngFor="let message of messages" [innerHTML]="message | keepHtml"></li>
</ul>
<ng-container *ngIf="messages.length === 0">No messages</ng-container>
</div>
<div class="col-12">
<hr/>
<label>New Message</label>
<textarea class="form-control" [(ngModel)]="model.message" name="message"></textarea>
<button class="btn btn-success mt-2" (click)="submit()">Send Message</button>
</div>
</div>




Pipe



import { Pipe, PipeTransform } from '@angular/core';
import { DomSanitizer } from '@angular/platform-browser';

@Pipe({ name: 'keepHtml', pure: false })
export class EscapeHtmlPipe implements PipeTransform {
constructor(private sanitizer: DomSanitizer) {
}

transform(content) {
return this.sanitizer.bypassSecurityTrustHtml(content);
}
}


I want to send message <script>alert('1');</script> and let the alert run










share|improve this question
























  • Probably not the best approach for teaching if you have to do extra work to make the attack possible. I would use an example where it is easy to get it wrong.
    – Henry
    Nov 22 at 7:27










  • Check this out angular.io/guide/security
    – holydragon
    Nov 22 at 7:29










  • have you tried bypassSecurityTrustScript ?
    – PierreDuc
    Nov 22 at 7:29










  • I get this error with bypassSecurityTrustScript: "Required a safe HTML, got a Script"
    – Michalis
    Nov 22 at 7:31










  • @Henry I want to make them see the actual problem and the actual solution from angular
    – Michalis
    Nov 22 at 7:32















up vote
1
down vote

favorite












I want to create an example of xss attack, with angular 7, for teaching purposes.



<div class="container mt-3">
<div class="row">
<div class="col-12">
<ul>
<li *ngFor="let message of messages">{{message}}</li>
<li *ngFor="let message of messages" [innerHTML]="message"></li>
<li *ngFor="let message of messages" [innerHTML]="message | keepHtml"></li>
</ul>
<ng-container *ngIf="messages.length === 0">No messages</ng-container>
</div>
<div class="col-12">
<hr/>
<label>New Message</label>
<textarea class="form-control" [(ngModel)]="model.message" name="message"></textarea>
<button class="btn btn-success mt-2" (click)="submit()">Send Message</button>
</div>
</div>




Pipe



import { Pipe, PipeTransform } from '@angular/core';
import { DomSanitizer } from '@angular/platform-browser';

@Pipe({ name: 'keepHtml', pure: false })
export class EscapeHtmlPipe implements PipeTransform {
constructor(private sanitizer: DomSanitizer) {
}

transform(content) {
return this.sanitizer.bypassSecurityTrustHtml(content);
}
}


I want to send message <script>alert('1');</script> and let the alert run










share|improve this question
























  • Probably not the best approach for teaching if you have to do extra work to make the attack possible. I would use an example where it is easy to get it wrong.
    – Henry
    Nov 22 at 7:27










  • Check this out angular.io/guide/security
    – holydragon
    Nov 22 at 7:29










  • have you tried bypassSecurityTrustScript ?
    – PierreDuc
    Nov 22 at 7:29










  • I get this error with bypassSecurityTrustScript: "Required a safe HTML, got a Script"
    – Michalis
    Nov 22 at 7:31










  • @Henry I want to make them see the actual problem and the actual solution from angular
    – Michalis
    Nov 22 at 7:32













up vote
1
down vote

favorite









up vote
1
down vote

favorite











I want to create an example of xss attack, with angular 7, for teaching purposes.



<div class="container mt-3">
<div class="row">
<div class="col-12">
<ul>
<li *ngFor="let message of messages">{{message}}</li>
<li *ngFor="let message of messages" [innerHTML]="message"></li>
<li *ngFor="let message of messages" [innerHTML]="message | keepHtml"></li>
</ul>
<ng-container *ngIf="messages.length === 0">No messages</ng-container>
</div>
<div class="col-12">
<hr/>
<label>New Message</label>
<textarea class="form-control" [(ngModel)]="model.message" name="message"></textarea>
<button class="btn btn-success mt-2" (click)="submit()">Send Message</button>
</div>
</div>




Pipe



import { Pipe, PipeTransform } from '@angular/core';
import { DomSanitizer } from '@angular/platform-browser';

@Pipe({ name: 'keepHtml', pure: false })
export class EscapeHtmlPipe implements PipeTransform {
constructor(private sanitizer: DomSanitizer) {
}

transform(content) {
return this.sanitizer.bypassSecurityTrustHtml(content);
}
}


I want to send message <script>alert('1');</script> and let the alert run










share|improve this question















I want to create an example of xss attack, with angular 7, for teaching purposes.



<div class="container mt-3">
<div class="row">
<div class="col-12">
<ul>
<li *ngFor="let message of messages">{{message}}</li>
<li *ngFor="let message of messages" [innerHTML]="message"></li>
<li *ngFor="let message of messages" [innerHTML]="message | keepHtml"></li>
</ul>
<ng-container *ngIf="messages.length === 0">No messages</ng-container>
</div>
<div class="col-12">
<hr/>
<label>New Message</label>
<textarea class="form-control" [(ngModel)]="model.message" name="message"></textarea>
<button class="btn btn-success mt-2" (click)="submit()">Send Message</button>
</div>
</div>




Pipe



import { Pipe, PipeTransform } from '@angular/core';
import { DomSanitizer } from '@angular/platform-browser';

@Pipe({ name: 'keepHtml', pure: false })
export class EscapeHtmlPipe implements PipeTransform {
constructor(private sanitizer: DomSanitizer) {
}

transform(content) {
return this.sanitizer.bypassSecurityTrustHtml(content);
}
}


I want to send message <script>alert('1');</script> and let the alert run







angular xss angular7






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 27 at 9:35









Goncalo Peres

1,3091317




1,3091317










asked Nov 22 at 7:25









Michalis

2,04112541




2,04112541












  • Probably not the best approach for teaching if you have to do extra work to make the attack possible. I would use an example where it is easy to get it wrong.
    – Henry
    Nov 22 at 7:27










  • Check this out angular.io/guide/security
    – holydragon
    Nov 22 at 7:29










  • have you tried bypassSecurityTrustScript ?
    – PierreDuc
    Nov 22 at 7:29










  • I get this error with bypassSecurityTrustScript: "Required a safe HTML, got a Script"
    – Michalis
    Nov 22 at 7:31










  • @Henry I want to make them see the actual problem and the actual solution from angular
    – Michalis
    Nov 22 at 7:32


















  • Probably not the best approach for teaching if you have to do extra work to make the attack possible. I would use an example where it is easy to get it wrong.
    – Henry
    Nov 22 at 7:27










  • Check this out angular.io/guide/security
    – holydragon
    Nov 22 at 7:29










  • have you tried bypassSecurityTrustScript ?
    – PierreDuc
    Nov 22 at 7:29










  • I get this error with bypassSecurityTrustScript: "Required a safe HTML, got a Script"
    – Michalis
    Nov 22 at 7:31










  • @Henry I want to make them see the actual problem and the actual solution from angular
    – Michalis
    Nov 22 at 7:32
















Probably not the best approach for teaching if you have to do extra work to make the attack possible. I would use an example where it is easy to get it wrong.
– Henry
Nov 22 at 7:27




Probably not the best approach for teaching if you have to do extra work to make the attack possible. I would use an example where it is easy to get it wrong.
– Henry
Nov 22 at 7:27












Check this out angular.io/guide/security
– holydragon
Nov 22 at 7:29




Check this out angular.io/guide/security
– holydragon
Nov 22 at 7:29












have you tried bypassSecurityTrustScript ?
– PierreDuc
Nov 22 at 7:29




have you tried bypassSecurityTrustScript ?
– PierreDuc
Nov 22 at 7:29












I get this error with bypassSecurityTrustScript: "Required a safe HTML, got a Script"
– Michalis
Nov 22 at 7:31




I get this error with bypassSecurityTrustScript: "Required a safe HTML, got a Script"
– Michalis
Nov 22 at 7:31












@Henry I want to make them see the actual problem and the actual solution from angular
– Michalis
Nov 22 at 7:32




@Henry I want to make them see the actual problem and the actual solution from angular
– Michalis
Nov 22 at 7:32

















active

oldest

votes











Your Answer






StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53425793%2fallow-angular-xss-attack%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown






























active

oldest

votes













active

oldest

votes









active

oldest

votes






active

oldest

votes
















draft saved

draft discarded




















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.





Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


Please pay close attention to the following guidance:


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53425793%2fallow-angular-xss-attack%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Berounka

Sphinx de Gizeh

Different font size/position of beamer's navigation symbols template's content depending on regular/plain...