Cross-site Scripting (XSS) Affecting angular package, versions <1.2.0

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). DOM event handlers await events to occur (e.g. onclick, onkeypress, etc) and execute arbitrary Javascript code in accordance to the event. By default, interpolations inside DOM event handlers are disallowed. Using an interpolation for such handlers means that the interpolated value is a JS string being evaluated. Storing or generating such strings is error prone and likely leads to a Cross-site Scripting (XSS) vulnerability if you're not careful. On the other hand, ng-click and such event handlers evaluate Angular expressions that are a lot safer (e.g. No direct access to global objects - only scope), cleaner and harder to exploit.

To migrate the code follow the example below: Before:

JS:   scope.foo = 'alert(1)';

HTML: <div onclick="{{foo}}">

After:

JS:   scope.foo = function() { alert(1); }

HTML: <div ng-click="foo()">

• GitHub Commit

• GitHub PR