Repository navigation
Script elements in template files should be innert #2766
Description
Given a template:
some component template containing script tag
<script>
console.log('dfsdf');
alert("hello");
</script>associated with a component:
@Component({
selector: 'test-component'
})
@View({
template: 'test-component.html'
})
...when the component is instantiated the script executes.
The root cause of this issue appears to be that we use document.importNode(node, true) when importing contents from the template into the main document. During this import the script element is revived and once appended to the document it's executed.
In Angular component templates this behavior is undesirable since the script is very limited in what it can do (it has no access to the context, di, etc) and only exposes large security vulnerability surface.
Tested with alpha-28.
Activity
[-]Template files should be innert[/-][+]Script elements in template files should be innert[/+]4 remaining items
tbosch commentedon Jul 30, 2015
Related, as it allows to clone templates via
element.innerHTMLwhich does not trigger script elements: #3364mhevery commentedon Aug 4, 2015
I think we should just remove
<script>tags in compilation. (Optionally move them into HEAD if that is want.)pkozlowski-opensource commentedon Aug 5, 2015
I would vote for removing those tags altogether as I don't think we want to act as a "poor's man" loader via templates. Will send a first-shot PR so we can discuss.
fix(compiler): strip <script> tag from templates
mhevery commentedon Aug 6, 2015
@pkozlowski-opensource SGTM
fix(compiler): strip <script> tag from templates
IgorMinar commentedon Jun 29, 2016
@ianbelcher can you please open a new issue requesting JSON-LD support and reference this issue there? thank you!
angular-automatic-lock-bot commentedon Sep 8, 2019
This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.
Read more about our automatic conversation locking policy.
This action has been performed automatically by a bot.