Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

Commit a3b1f41

Browse files
committed
fixup! feat($compile): add support for arbitrary property and event bindings
1 parent 8e65bdd commit a3b1f41

File tree

2 files changed

+7
-11
lines changed

2 files changed

+7
-11
lines changed
Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
@ngdoc error
22
@name $compile:nodomevents
3-
@fullName Interpolated Event Attributes
3+
@fullName Event Attribute/Property Binding
44
@description
55

6-
This error occurs when one tries to create a binding for event handler attributes like `onclick`, `onload`, `onsubmit`, etc.
6+
This error occurs when one tries to create a binding for event handler attributes or properties like `onclick`, `onload`, `onsubmit`, etc.
77

8-
There is no practical value in binding to these attributes and doing so only exposes your application to security vulnerabilities like XSS.
9-
For these reasons binding to event handler attributes (all attributes that start with `on` and `formaction` attribute) is not supported.
8+
There is no practical value in binding to these attributes/properties and doing so only exposes your application to security vulnerabilities like XSS.
9+
For these reasons binding to event handler attributes and properties (`formaction` and all starting with `on`) is not supported.
1010

1111

1212
An example code that would allow XSS vulnerability by evaluating user input in the window context could look like this:
@@ -17,4 +17,4 @@ An example code that would allow XSS vulnerability by evaluating user input in t
1717

1818
Since the `onclick` evaluates the value as JavaScript code in the window context, setting the `username` model to a value like `javascript:alert('PWND')` would result in script injection when the `div` is clicked.
1919

20-
20+
Please use the `ng-*` or `ng-on-*` versions instead (such as `ng-click` or `ng-on-click` rather than `onclick`).

src/ng/compile.js

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3470,9 +3470,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
34703470
}
34713471
function addPropertyDirective(node, directives, attrName, propName) {
34723472
if (EVENT_HANDLER_ATTR_REGEXP.test(propName)) {
3473-
throw $compileMinErr('nodomevents',
3474-
'Property bindings for HTML DOM event properties are disallowed. Please use the ' +
3475-
'ng- versions (such as ng-click or ng-on-click rather than ng-prop-onclick) instead.');
3473+
throw $compileMinErr('nodomevents', 'Property bindings for HTML DOM event properties are disallowed');
34763474
}
34773475

34783476
var nodeName = nodeName_(node);
@@ -3529,9 +3527,7 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
35293527
}
35303528

35313529
if (EVENT_HANDLER_ATTR_REGEXP.test(name)) {
3532-
throw $compileMinErr('nodomevents',
3533-
'Interpolations for HTML DOM event attributes are disallowed. Please use the ' +
3534-
'ng- versions (such as ng-click or ng-on-click rather than onclick) instead.');
3530+
throw $compileMinErr('nodomevents', 'Interpolations for HTML DOM event attributes are disallowed');
35353531
}
35363532

35373533
directives.push({

0 commit comments

Comments
 (0)