create HTML sanitizer to allow inclusion of untrusted HTML in safe manner.

Sanitization works in two phases:
 1) We parse the HTML into sax-like events (start, end, chars).
    HTML parsing is very complex, and so it may very well be that what
    most browser consider valid HTML may not pares properly here,
    but we do best effort. We treat this parser as untrusted.
 2) We have safe sanitizeWriter which treats its input (start, end, chars)
    as untrusted content and escapes everything. It only allows elements
    in the whitelist and only allows attributes which are whitelisted.
    Any attribute value must not start with 'javascript:'. This check
    is performed after escaping for entity (&xAB; etc..) and ignoring
    any whitespace.

 - Correct linky filter to use safeHtmlWriter
 - Correct html filter to use safeHtmlWriter

Close #33; Close #34

1 files changed, 7 insertions, 3 deletions

diff --git a/src/directives.js b/src/directives.js
index 49f0343d..a1fa4740 100644
--- a/src/directives.js
+++ b/src/directives.js
@@ -26,15 +26,19 @@ angularDirective("ng:bind", function(expression){
   return function(element) {
     var lastValue = noop, lastError = noop;
     this.$onEval(function() {
-      var error, value, isHtml, isDomElement,
+      var error, value, html, isHtml, isDomElement,
           oldElement = this.hasOwnProperty($$element) ? this.$element : _undefined;
       this.$element = element;
       value = this.$tryEval(expression, function(e){
         error = toJson(e);
       });
       this.$element = oldElement;
+      // If we are HTML than save the raw HTML data so that we don't
+      // recompute sanitization since it is expensive.
+      // TODO: turn this into a more generic way to compute this
+      if (isHtml = (value instanceof HTML))
+        value = (html = value).html;
       if (lastValue === value && lastError == error) return;
-      isHtml = value instanceof HTML;
       isDomElement = isElement(value);
       if (!isHtml && !isDomElement && isObject(value)) {
         value = toJson(value);
@@ -45,7 +49,7 @@ angularDirective("ng:bind", function(expression){
         elementError(element, NG_EXCEPTION, error);
         if (error) value = error;
         if (isHtml) {
-          element.html(value.html);
+          element.html(html.get());
         } else if (isDomElement) {
           element.html('');
           element.append(value);