ngSanitize should preserve data attributes

[corinna000]

The list of valid element attributes does not include data attributes.

I have a use case for dynamically generating html snippets on a server which I'd like to sanitize before displaying. This puts me in a position of hacking around the issue by encoding my data within the class list (or inside some other "safe" html attribute).

I think I can create a pull request that would have htmlSanitizeWriter check for data attributes within the loop that builds the sanitized elements.

Any support for this?

[petebacondarwin]

If you are dynamically generating snippets on the server, then you should be able to sanitize them there.
In which case you can mark them in your Angular app as trusted HTML and not use the sanitizer at all in the app. See https://docs.angularjs.org/api/ng/service/$sce/#show-me-an-example-using-sce-

[gkalpak]

Regardless of this specific usecase, is there a reason why data-* attributes are not considered safe ?

[Chexpir]

+1 on the question. Regardless of this specific usecase, is there a reason why data-* attributes are not considered safe ?

[lgalfaso]

Without a valid use case it is hard to assess this issue

On Tuesday, June 21, 2016, Chexpir notifications@github.com wrote:

+1 on the question. Regardless of this specific usecase, is there a reason
why data-* attributes are not considered safe ?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#13112 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AAX44kXmwz1X6xcgZaoJSBQ8WCN1gjHOks5qN7eqgaJpZM4GQWkw
.

[Chexpir]

My use case

• I have an element directive xxx
• I was trying to use an attribute on that directive called data-yyy and I have it in my directive isolated scope as dataYyy : '='
  So I was using it in my html code as
  On runtime, this data was coming as undefined, as it was skipped by the sanitizer, with no warning, as unsafe. In my case, I worked around in changing the name of the variable data-yyy to a different name.

[gkalpak]

@Chexpir, this sounds like a totally different problem. Are you sure it is the sanitizer and not Angular stripping the data- prefix. Does it work if you use data-data-yyy in your HTML?

[lgalfaso]

@Chexpir this is interesting, ngSanitize is meant to run on untrusted html. Now, it looks like you are compiling the sanitized html code (as this is the only way for a directive xxx to be executed). If you do this and we keep the data- attributes, then you run into a security issue as the user will be able to run any directive that can use attributes.

This is, your use case opens a security issue.

I will keep this issue open for a few more days, but I am still unable to see a valid use case.

[lgalfaso]

@Chexpir the mapping from an attribute name to directive is done after the attribute name is normalized https://docs.angularjs.org/api/ng/service/$compile#attributes
https://docs.angularjs.org/guide/directive#normalization