mirror of
https://github.com/zhigang1992/angular.js.git
synced 2026-03-30 17:03:39 +08:00
61 lines
2.1 KiB
Plaintext
61 lines
2.1 KiB
Plaintext
@ngdoc overview
|
|
@name Security
|
|
@sortOrder 525
|
|
@description
|
|
|
|
# Security
|
|
|
|
This document explains some of AngularJS's security features and best practices that you should
|
|
keep in mind as you build your application.
|
|
|
|
|
|
## Expression Sandboxing
|
|
|
|
AngularJS's expressions are sandboxed not for security reasons, but instead to maintain a proper
|
|
separation of application responsibilities. For example, access to `window` is disallowed
|
|
because it makes it easy to introduce brittle global state into your application.
|
|
|
|
However, this sandbox is not intended to stop attackers who can edit the template before it's
|
|
processed by Angular. It may be possible to run arbitrary JavaScript inside double-curly bindings
|
|
if an attacker can modify them.
|
|
|
|
But if an attacker can change arbitrary HTML templates, there's nothing stopping them from doing:
|
|
|
|
```html
|
|
<script>somethingEvil();</script>
|
|
```
|
|
|
|
It's better to design your application in such a way that users cannot change client-side templates.
|
|
For instance:
|
|
|
|
* Do not mix client and server templates
|
|
* Do not use user input to generate templates dynamically
|
|
* Do not run user input through `$scope.$eval`
|
|
* Consider using {@link ng.directive:ngCsp CSP} (but don't rely only on CSP)
|
|
|
|
## Mixing client-side and server-side templates
|
|
|
|
In general, we recommend against this because it can create unintended XSS vectors.
|
|
|
|
However, it's ok to mix server-side templating in the bootstrap template (`index.html`) as long
|
|
as user input cannot be used on the server to output html that would then be processed by Angular
|
|
in a way that would cause allow for arbitrary code execution.
|
|
|
|
For instance, you can use server-side templating to dynamically generate CSS, URLs, etc, but not
|
|
for generating templates that are bootstrapped/compiled by Angular.
|
|
|
|
|
|
## Reporting a security issue
|
|
|
|
Email us at [security@angularjs.org](mailto:security@angularjs.org) to report any potential
|
|
security issues in AngularJS.
|
|
|
|
Please keep in mind the above points about Angular's expression language.
|
|
|
|
|
|
## See also
|
|
|
|
* {@link ng.directive:ngCsp Content Security Policy}
|
|
* {@link ng.$sce Strict Contextual Escaping}
|
|
* {@link ngSanitize.$sanitize $sanitize}
|