search

holmesal / hashtag

shortwave on the internets
2 stars 0 forks source link

Don't let people send arbitrary javascript #14

Closed holmesal closed 10 years ago

holmesal commented 10 years ago

Ya doofus.

Sending the message <script type="text/javascript">alert("hi matt")</script> executes said code in the browser, because $sce has trusted message text as a valid HTML source. Need to do something smarter instead.

holmesal commented 10 years ago

Done, moved to using the ng-sanitize linky filter