AngularJS 是否默认保护用户输入的 XSS 攻击？

Question

I have seen that when I am adding HTML or JS content to the DB and then print it with AngularJS, like this: {{theDataAddedToDB}} it ignores the HTML tags and then it is protected from XSS.

Now that is nice to assume - but is it enough to be sure that my projects are XSS protected when I am using the AngularJS?

(I am talking about user input by itself, not about third party plugins or something else, just user inputs XSS).

Thanks.

Answer 1

By making use of $sceProvider and $SanitizeProvider we can avoid xss attacks in angularjs.

use these library as per angular js norm:

<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/angularjs/1.3.3/angular.min.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/angularjs/1.3.3/angular-sanitize.min.js"></script>

and then in script tag the code could be written like this:

<script type="text/javascript">
angular.module('HelloApp', ["ngSanitize"])
.controller('HelloCtrl', ['$scope', '$sce', function($scope, $sce){
$scope.name="";
$scope.processHtmlCode=function() {
$scope.helloMessage = "<h1>" + $scope.name + "</h1>";
$scope.trustedMessage =  $sce.trustAsHtml( $scope.name );
}
}])
</script>