I have seen conflicting reports that it is dangerous to use the [innerHTML] tag in Angular2+. Is that still the case or has it since been fixed?
for example is this code dangerous:
<div [innerHTML]="post.body"></div>
2 Answers
I confirm.
I just tried the following
<div [innerHTML]="<span (touch)=() => {alert('Code has been successfully executed on client from external malicious input');}">test xss</span>"></div>
Nothing is executed and the DOM inspection shows that (touch) has been removed from the span by angular. It's all good ;-)
Related