-
Notifications
You must be signed in to change notification settings - Fork 13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ngSanitize #5
Comments
I modified your code as below.
|
@xh4n3 this should be solved in the angular application module and not in the markdown module. |
Thanks for the detailed reply. |
@xh4n3 I'm happy with all feedback and appreciate the discussion. Here is an example where the injected script is successfully removed: 'use strict';
angular
.module('appApp', [
'ngSanitize',
'markdown'
])
.controller('MainCtrl', function ($scope) {
$scope.text = '# Subject\n<script>alert(0);</script>\nThis is the first paragraph.\n';
}); <div ng-bind-html="text | markdown"> <!-- Result -->
<div ng-bind-html="text | markdown" class="ng-binding ng-scope">
<h1>Subject</h1>
<p>This is the first paragraph.</p>
</div> How does this method work for you? |
@vpegado Yes, this works like a charm! |
@xh4n3, I've now updated https://github.com/vpegado/angular-markdown-filter/blob/master/README.md |
@vpegado |
Sir,
I've been using your code on my blog, but note the example you gave in the README could lead to XSS problems.
Use ngSanitize?
The text was updated successfully, but these errors were encountered: