Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

fix(ngSanitize): Blacklist the attribyte usemap #13826

Closed
wants to merge 1 commit into from

Conversation

lgalfaso
Copy link
Contributor

Given that the attribute name is blacklisted, the attribute usemap should be
blacklisted too.

Given that the attribute `name` is blacklisted, the attribute `usemap` should be
blacklisted too.
lgalfaso added a commit that referenced this pull request Jan 22, 2016
Given that the attribute `name` is blacklisted, the attribute `usemap` should be
blacklisted too.

Closes: ##13826
@Narretz
Copy link
Contributor

Narretz commented Jan 24, 2016

This has landed in master, I guess we should backport to 1.4?

@petebacondarwin
Copy link
Contributor

Difficulty is that it is a BC for 1.4

@Narretz
Copy link
Contributor

Narretz commented Jan 25, 2016

Ok, then let's just keep it as it is in 1.4

@Narretz Narretz closed this Jan 25, 2016
@breadtk
Copy link

breadtk commented Feb 2, 2016

FWIW the change log calls this out simply as a breaking change. Perhaps it should be relabeled as a "Security Note" to denote its importance?

gkalpak added a commit that referenced this pull request Feb 3, 2016
@breadtk
Copy link

breadtk commented Feb 6, 2016

Thanks @gkalpak!

@marekciupak
Copy link

marekciupak commented Jun 28, 2016

Since this one wasn't applied to 1.2.x branch, should I consider 1.2.x version as vulnerable or the problem in 1.2 does not exist?

I'm wondering if the fixes are still applied to 1.2.x. The official web page suggests that there are, but wanted to make sure the description in the page is updated.

This branch contains a legacy version of AngularJS that supports IE8 (v1.2.x on Github) (..)will only receive security fixes (...)

@gkalpak
Copy link
Member

gkalpak commented Jul 12, 2016

@marekciupak, you are right, this should be backported to 1.2.x 👍
On it...

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants