idan/SecLists
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #388 from Lavaei/master

Browse Source 
Add innerHTML as dangerous input in Angular 2+
This commit is contained in:
g0tmi1k
2020-02-13 14:47:41 +00:00
committed by GitHub
parent 916d54df11 92fb303ba0
commit 709d6ebeb5
2 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@@ -1,3 +1,4 @@
.DS_Store
.*.icloud
.gitkeep
.idea

6
Pattern-Matching/dangerous-functions-angular.txt
View File

@@ -1,8 +1,14 @@
# Angular pipes
bypassSecurityTrustHtml
bypassSecurityTrustScript
bypassSecurityTrustStyle
bypassSecurityTrustUrl
bypassSecurityTrustResourceUrl
# Angular inputs
[innerHTML] #Insert given HTML without escaping dangerous characters
# angular.js (aka Angular 1)
trustAsHtml
$eval
$evalAsync