fix(toast): better toast templating allowing comments and sibling elements #6494

devversion · 2015-12-29T17:23:01Z

EladBezalel · 2015-12-30T21:41:52Z

LGTM. @jelbourn thoughts?

jelbourn · 2016-01-04T16:33:15Z

src/components/toast/toast.js

@@ -289,18 +289,16 @@ function MdToastProvider($$interimElementProvider) {
          // Root element of template will be <md-toast>. We need to wrap all of its content inside of
          // of <div class="md-toast-content">. All templates provided here should be static, developer-controlled
          // content (meaning we're not attempting to guard against XSS).
-          var parsedTemplate = angular.element(template);
-          var wrappedContent = '<div class="md-toast-content">' + parsedTemplate.html() + '</div>';
+          var parsedTemplate = angular.element(template.replace(/<!--(.*?)-->/g, ''));


This doesn't work because Angular actually lets you apply directives as comments.

https://docs.angularjs.org/guide/directive

devversion · 2016-01-04T18:08:00Z

@jelbourn - But to get our actual target we need to get a element, which allows children. Can you please take a look at my new version?

jelbourn · 2016-01-05T23:30:01Z

src/components/toast/toast.js

-          parsedTemplate.empty().append(wrappedContent);
+          for (var i = 0; i < parsedTemplate.length; i++) {
+            if (parsedTemplate[i].nodeType != Node.COMMENT_NODE) {
+              parsedTemplate = parsedTemplate.eq(i);


Wouldn't this not work for a template like this?

<span> An element </span> <span> A sibling element </span>

devversion · 2016-01-05T23:42:11Z

@jelbourn - I need one decision from you. What should we do if we got two silbings as roots. Should we pick the first node, which allows to have childs. Or should we always use md-toast

jelbourn · 2016-01-05T23:59:17Z

I think a much more straightforward approach would be to change parsedTemplate to a <template> element (using document.createElement) and set its innerHTML instead of using angular.element.

…ments Fixes angular#6259

devversion · 2016-01-06T12:49:12Z

@jelbourn - Now it works perfectly. It allows comments, it allows sibling elements, it allows normal md-toast templates. It removes all the toasts correctly from the DOM - PS: <template> is not good, it is reserved for modern browsers as a directive

jelbourn · 2016-01-06T18:34:03Z

LGTM

…ments Fixes #6259 Closes #6494

…ments Fixes angular#6259 Closes angular#6494

protect against a possible XSS vector Related to #6494. Related to #6259.

ThomasBurleson assigned EladBezalel Dec 29, 2015

EladBezalel added the needs: review This PR is waiting on review from the team label Dec 31, 2015

EladBezalel assigned jelbourn and unassigned EladBezalel Dec 31, 2015

jelbourn reviewed Jan 4, 2016
View reviewed changes

devversion force-pushed the fix/toast-template-comments branch from 5b58b47 to 414bb6b Compare January 4, 2016 18:06

jelbourn reviewed Jan 5, 2016
View reviewed changes

devversion force-pushed the fix/toast-template-comments branch from 414bb6b to 842b0ac Compare January 6, 2016 12:47

fix(toast): better toast templating allowing comments and sibling ele…

4afb004

…ments Fixes angular#6259

devversion force-pushed the fix/toast-template-comments branch from 842b0ac to 4afb004 Compare January 6, 2016 12:48

jelbourn added pr: merge ready This PR is ready for a caretaker to review and removed needs: review This PR is waiting on review from the team labels Jan 6, 2016

ThomasBurleson closed this in 43d5387 Mar 30, 2016

ThomasBurleson pushed a commit that referenced this pull request Apr 1, 2016

fix(toast): better toast templating allowing comments and sibling ele…

bb7bc90

…ments Fixes #6259 Closes #6494

ThomasBurleson pushed a commit that referenced this pull request Apr 1, 2016

fix(toast): better toast templating allowing comments and sibling ele…

57a929a

…ments Fixes #6259 Closes #6494

gmoothart pushed a commit to gmoothart/material that referenced this pull request Apr 5, 2016

fix(toast): better toast templating allowing comments and sibling ele…

fee15e1

…ments Fixes angular#6259 Closes angular#6494

devversion deleted the fix/toast-template-comments branch April 19, 2016 19:49

Splaktar changed the title ~~fix(toast): strip comments from template to prevent error throwing~~ fix(toast): handle comments in templates Feb 23, 2019

Splaktar changed the title ~~fix(toast): handle comments in templates~~ fix(toast): better toast templating allowing comments and sibling elements Feb 23, 2019

Splaktar added a commit that referenced this pull request Feb 23, 2019

fix(toast): sanitize custom toast templates

af2ea21

protect against a possible XSS vector Related to #6494. Related to #6259.

Splaktar mentioned this pull request Feb 23, 2019

WIP: fix(toast): sanitize auto wrapped custom toast templates #11652

Closed

3 tasks

Splaktar added a commit that referenced this pull request Feb 23, 2019

fix(toast): sanitize custom toast templates

ef7e1eb

protect against a possible XSS vector Related to #6494. Related to #6259.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(toast): better toast templating allowing comments and sibling elements #6494

fix(toast): better toast templating allowing comments and sibling elements #6494

devversion commented Dec 29, 2015

EladBezalel commented Dec 30, 2015

jelbourn Jan 4, 2016

devversion commented Jan 4, 2016

jelbourn Jan 5, 2016

devversion commented Jan 5, 2016

jelbourn commented Jan 5, 2016

devversion commented Jan 6, 2016

jelbourn commented Jan 6, 2016

fix(toast): better toast templating allowing comments and sibling elements #6494

fix(toast): better toast templating allowing comments and sibling elements #6494

Conversation

devversion commented Dec 29, 2015

EladBezalel commented Dec 30, 2015

jelbourn Jan 4, 2016

Choose a reason for hiding this comment

devversion commented Jan 4, 2016

jelbourn Jan 5, 2016

Choose a reason for hiding this comment

devversion commented Jan 5, 2016

jelbourn commented Jan 5, 2016

devversion commented Jan 6, 2016

jelbourn commented Jan 6, 2016