Keeping the Sand Out of Your Eyes No Sandbox, No Problem
summary
Claim: AngularJS 1.6 removes the expression sandbox and that removal exposes template injection when user data becomes executable template source. Demonstrated failure modes: concatenating user.name into $compile strings and server‑side substitution into bootstrapped templates, which let attacker expressions set variables or exfiltrate tokens. Fixes shown: use ng-non-bindable, stop mixing server and client templates, audit APIs that interpret strings, bootstrap only where you control DOM, and actively fuzz or probe apps to find and patch these vulnerabilities.
AI-written summary · about
chapters (11)
- 0:00Start
- 4:20Review #2
- 4:55Different Context
- 5:50Could not access prototype...
- 6:00From The Blog Post
- 8:491 Passing user content to $compile
- 12:51Where's the danger?
- 16:26Food For Thought #2
- 17:30Guideline #3
- 18:18Guideline #4
- 18:44Remember...
related talks
51mAn Abusive Relationship with AngularJS
49mAn Abusive Relationship with AngularJS
17mThere's Safety in Angular
24mSecurity in Angular 2
45mAn Abusive Relationship with AngularJS v2
31mBoosting the security of your Angular 2 application
31mAngular and the OWASP top 10
06mSupercharge Your Angular Development Workflow