HTML filter should be safe and we should have unsafeHTML filter about angular.js HOT 3 CLOSED

preferred implementation would be here: http://code.google.com/p/google-caja/source/browse/trunk/src/com/google/caja/plugin/html-sanitizer.js

from angular.js.

Interesting resource: http://ha.ckers.org/xss.html
Parser: http://ejohn.org/blog/pure-javascript-html-parser/

from angular.js.

create HTML sanitizer to allow inclusion of untrusted HTML in safe manner.

Sanitization works in two phases:

1. We parse the HTML into sax-like events (start, end, chars).
   HTML parsing is very complex, and so it may very well be that what
   most browser consider valid HTML may not pares properly here,
   but we do best effort. We treat this parser as untrusted.
2. We have safe sanitizeWriter which treats its input (start, end, chars)
   as untrusted content and escapes everything. It only allows elements
   in the whitelist and only allows attributes which are whitelisted.
   Any attribute value must not start with 'javascript:'. This check
   is performed after escaping for entity (&xAB; etc..) and ignoring
   any whitespace.

• Correct linky filter to use safeHtmlWriter
• Correct html filter to use safeHtmlWriter

Closed by 6c8107b4305a6684794f7a531ff1362b71dbc5ae; Closed by 6c8107b4305a6684794f7a531ff1362b71dbc5ae

from angular.js.