Re:Stealing passwords from McDonald's users
by catmanjan on Sunday January 15, 2017 @10:55PM
(#13408109)
If you're displaying user input you could just encode to their matching HTML entities...
{ or the human friendlier one &rcurb (?)
that doesn't work because the HTML entity decoding happens before Angular does the scanning of the DOM for the brackets. So even if you use &rcurb; output from the server, Angular will still interpret the brackets "properly"
As to why this works this way, consider the following:
do you have to do HTML entity decoding when getting an input value from Javascript?
- Have the possibility of {{ and }} in your server-side output (or whatever symbols you configured Angular for)
- Have Angular.JS on a page with server-side output
Choose one.
It's important to realize that this affects things like user input as well. So form initials/form defaults can also be affected by this issue!
A bit of a silly way to fix this problem is to modify your server-side escaping function (surely you have this!) to "escape" {{ with {<zero-width space>{. This will mess up things that need to be equal to each other, and can poison user input (because of form initials) but will protect you from this issue.