HTML Sanitization removes HTML5 Video elements

[zoehneto]

I'm submitting a ... (check one with "x")

[x] bug report
[ ] feature request
[ ] support request => Please do not submit support request here, instead see https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question

Current behavior
Since the introduction of html sanitization with rc2, html5 video elements get removed when binding html to the innerHTML property of an element.

Expected/desired behavior
Video elements should be retained just like img elements.

What is the motivation / use case for changing the behavior?
I need to incorporate external html into my app and if sanitization removes video elements I need to turn it off, which causes security issues.

Please tell us about your environment:

• Angular version: 2.0.0-rc.2 and rc.3
• Browser: [all]
• Language: [all]

[pe8ter]

Inject this service into your component and pass your unsafe markup through the bypass function that makes sense for your scenario.

[vicb]

thanks @pe8ter

@zoehneto Also check the security doc

[zoehneto]

As mentioned in issue #8511 I would like to avoid completely bypassing the sanitization. Is there a security reason for removing video elements, or could they be allowed by default like img elements?

[mprobst]

Sorry, we should indeed fix that by allowing video elements, the sanitizer is just a bit out of date (i.e. pre-HTML5).

Right, @rjamet?

[cyrilletuzi]

I found the file to change and know the code to do. There are others HTML5 elements and attributes missing (like <main>).

I'll do it this afternoon, I just need help to do it correctly as it is my first time with contribution. How can I contact someone to guide me in the process ? Thanks.

[zoehneto]

Actually there are quite a few html5 elements missing, it would be great if you could go over this list, so we actually have all elements (for example the audio and source elements are also missing).

[cyrilletuzi]

Doing that now.

[rjamet]

I also took a stab at this, but I'm running into trouble with node... I agree with Martin, this seems carried over from Angular.js.

In my opinion:

• I'd avoid the track attribute, since some tracks allows CSS-like things, but this is justified only with gut feelings (spec: https://w3c.github.io/webvtt/#css-extensions)
• allowing source / audio / video and most of their attributes looks mostly fine (but remember, the attributes aren't tied to all elements, so if something could be dangerous elsewhere it's probably best to not add it). The only two pitfalls I see are poster (an URL that should be sanitized), and the crossorigin attribute that should be forbidden?

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}