AngularJS - Escaping the Expression Sandbox for XSS
UPDATE: This is a summary of XSS without HTML: Client-Side Template Injection with AngularJS. Previously the citation was in the middle of the document and difficult to find. The goal of the summary is to present the exploit and a fix without all the nuances, not to claim the work as my own.
Introduction
AngularJS is a popular JavaScript framework that allows embedding expressions within double curly braces. For example, the expression 1+2={{1+2}}
will render as 1+2=3
.
This means that if the server echos out user input that contains double curly braces, the user can perform a XSS exploit using…