From 33e1bdc543bcb7875dcc004d487333393670ed2d Mon Sep 17 00:00:00 2001 From: Peter Bacon Darwin Date: Sun, 16 Feb 2014 22:02:31 +0000 Subject: chore(errors): rename folders to match namespaces --- docs/content/error/compile/nodomevents.ngdoc | 20 -------------------- 1 file changed, 20 deletions(-) delete mode 100644 docs/content/error/compile/nodomevents.ngdoc (limited to 'docs/content/error/compile/nodomevents.ngdoc') diff --git a/docs/content/error/compile/nodomevents.ngdoc b/docs/content/error/compile/nodomevents.ngdoc deleted file mode 100644 index ed1888c7..00000000 --- a/docs/content/error/compile/nodomevents.ngdoc +++ /dev/null @@ -1,20 +0,0 @@ -@ngdoc error -@name $compile:nodomevents -@fullName Interpolated Event Attributes -@description - -This error occurs when one tries to create a binding for event handler attributes like `onclick`, `onload`, `onsubmit`, etc. - -There is no practical value in binding to these attributes and doing so only exposes your application to security vulnerabilities like XSS. -For these reasons binding to event handler attributes (all attributes that start with `on` and `formaction` attribute) is not supported. - - -An example code that would allow XSS vulnerability by evaluating user input in the window context could look like this: -``` - -
click me
-``` - -Since the `onclick` evaluates the value as JavaScript code in the window context, setting the `username` model to a value like `javascript:alert('PWND')` would result in script injection when the `div` is clicked. - - -- cgit v1.2.3