如何串联模板网址角度不太安全比在其他地方? [英] How is concatenating urls in templates in angular less secure than in other locations?
问题描述
我有一个angularjs模板,类似于此:
I have an angularjs template which looks similar to this:
<img ng:src="/resources/{{id}}/thumbnail" />
不过,这将导致一个 $插值:noconcat错误。相比之下,这个模板:
However this results in an $interpolate:noconcat error. In contrast to that this template:
<img ng:src="{{fullUrl}}" />
甚至是:
<img ng:src="{{id|createThumbnailURL}}" />
(其中createThumbnailURL是一个简单的过滤器,它确实与上述相同concatination)工作完全细
(where createThumbnailURL is a simple filter which does the same concatination as above) work totally fine.
该文件说:
串联前pressions使得它很难推理是否有些
连接值的组合是不安全的使用,可以很容易地
导致XSS。
Concatenating expressions makes it hard to reason about whether some combination of concatenated values are unsafe to use and could easily lead to XSS.
恩,是的,静态的URL总是比较容易比串联一个评估,我看有道理。然而,它听起来并不少见,我有REST的API有可以通过简单的串联构造URL和串联必须做的 somehwere 的。我能做到这一点在控制器甚至服务器端,而如何改善东西移到别处串联吗和什么是解决这个问题的推荐方法?
Well yes, a static URL is always easier to assess than a concatenated one, I see the point there. However it does not sound uncommon to me to have REST-APIs that have URLs that can be constructed by simple concatenation and that concatenation has to be done somehwere. I can do it in the controller or even server-side, but how does that improve anything to move the concatenation elsewhere? And what is the recommended way to deal with the problem?
更新
下面是错误示范:<一href=\"http://cipher-$c$c.de/tmp/angular3/index.xhtml\">http://cipher-$c$c.de/tmp/angular3/index.xhtml
也许它与页面存在XML做的。
Maybe it has to do with the page being XML.
推荐答案
这就是所谓的SCE(严格语境转义):
像许多严的模式,这是可配置。但是,随着V 1.2的它会自动设置为true。
This is called SCE (Strict Contextual Escaping): Like many "strictness" modes, this is configurable. But as of V 1.2 it is automatically set to true.
更具体地,在上下文角认为是易受伤害(如网址的),有允许(严)少插。您的网址串联被消毒。
More specifically, in contexts Angular considers to be vulnerable (like url's), there is less interpolation allowed (Strictness). Your URL concatenation is being "sanitized".
您已经知道了原因: XSS攻击的。它也可用于开发者的保护:轻微错误的URL可能导致数据删除或覆盖
You are already aware of the reason: XSS attacks. It's also used for the developer's protection: a slightly wrong url could cause data deletes or overwriting.
你可能感到困惑,为什么满弦插值 NG:SRC ={{fullUrl}}
是所以比字符串连接纳克安全得多:SRC =/资源/ {{ID}} /缩略图
。 TBH,我不知道有一个严重差异,但这些都是主观判断。
You're probably confused why full string interpolation ng:src="{{fullUrl}}"
is so much safer than string concatenation ng:src="/resources/{{id}}/thumbnail"
. TBH, I'm not sure there's a serious difference, but these are judgement calls.
您必须处理这一烦恼一些替代:
You have some alternatives for dealing with this annoyance:
1)裹在 $ sce.trustAs您的网址建设()
<img ng:src="sce.trustAs('url', '/resources/{{id}}/thumbnail')" />
2)您可以在您的应用程序禁用SCE,如果你选择
2) You can disable SCE across your application, if you choose
angular.module('myApp').config(function($sceProvider) {
$sceProvider.enabled(false);
});
更正:
您不能调用从指令的$ SCE服务。只有$范围服务直接可用。但是你可以使用函数(或使用功能的指令)。
You can't call the $sce service from a directive. Only the $scope service is directly available. But you can use a function (or a directive that uses a function).
$scope.createUrl = function (strName) {
var truststring = '/resources/' + strName + '/thumbnail';
return truststring;
}
和您的电话指令看起来像
and your directive call would look like
<img ng:src="{{ createUrl(id) }}" />
在此情况下,如果你的包在串联功能,你甚至可能不会需要去清理它,因为你不会被打破SCE规则。
In this case, if you wrap your concatenation in a function, you may not even need to de-sanitize it since you won't be breaking SCE rule.
这篇关于如何串联模板网址角度不太安全比在其他地方?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!