| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
The value attribute must be populated manually, since different
browsers default to different value of option when not explicitly
defined.
|
|
|
|
camelcase is used for other angular functions and forEach is also
used by EcmaScript standard.
- rename the internal as well as the external function name
- tweak the implementation of the function so that it doesn't
clober it self when we extend the angular object with an
object that has a forEach property equal to this forEach function
Closes #85
|
|
|
|
|
|
|
|
* explicitly require full URLs (ftp|https?://...)
* list the URI attributes
* remove a lot of unneeded attributes
|
|
|
|
Sanitization works in two phases:
1) We parse the HTML into sax-like events (start, end, chars).
HTML parsing is very complex, and so it may very well be that what
most browser consider valid HTML may not pares properly here,
but we do best effort. We treat this parser as untrusted.
2) We have safe sanitizeWriter which treats its input (start, end, chars)
as untrusted content and escapes everything. It only allows elements
in the whitelist and only allows attributes which are whitelisted.
Any attribute value must not start with 'javascript:'. This check
is performed after escaping for entity (&xAB; etc..) and ignoring
any whitespace.
- Correct linky filter to use safeHtmlWriter
- Correct html filter to use safeHtmlWriter
Close #33; Close #34
|
