Skip to content

Commit bd056ee

Browse files

File tree

5 files changed

+385
-657
lines changed

5 files changed

+385
-657
lines changed

docs/content/error/$sanitize/badparse.ngdoc

-11
This file was deleted.
+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
@ngdoc error
2+
@name $sanitize:noinert
3+
@fullName Can't create an inert html document
4+
@description
5+
6+
This error occurs when `$sanitize` sanitizer determines that `document.implementation.createHTMLDocument ` api is not supported by the current browser.
7+
8+
This api is necessary for safe parsing of HTML strings into DOM trees and without it the sanitizer can't sanitize the input.
9+
10+
The api is present in all supported browsers including IE 9.0, so the presence of this error usually indicates that Angular's `$sanitize` is being used on an unsupported platform.
+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
@ngdoc error
2+
@name $sanitize:uinput
3+
@fullName Failed to sanitize html because the input is unstable
4+
@description
5+
6+
This error occurs when `$sanitize` sanitizer tries to check the input for possible mXSS payload and the verification
7+
errors due to the input mutating indefinitely. This could be a sign that the payload contains code exploiting an mXSS
8+
vulnerability in the browser.
9+
10+
mXSS attack exploit browser bugs that cause some browsers parse a certain html strings into DOM, which once serialized
11+
doesn't match the original input. These browser bugs can be exploited by attackers to create payload which looks
12+
harmless to sanitizers, but due to mutations caused by the browser are turned into dangerous code once processed after
13+
sanitization.

lib/htmlparser/htmlparser.js

-309
This file was deleted.

0 commit comments

Comments
 (0)