Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

With ng-bind-html-unsafe removed, how do I inject HTML?

Tags:

html

angularjs

I'm trying to use $sanitize provider and the ng-bind-htm-unsafe directive to allow my controller to inject HTML into a DIV.

However, I can't get it to work.

<div ng-bind-html-unsafe="{{preview_data.preview.embed.html}}"></div> 

I discovered that it is because it was removed from AngularJS (thanks).

But without ng-bind-html-unsafe, I get this error:

http://errors.angularjs.org/undefined/$sce/unsafe

like image 841
metalaureate Avatar asked Oct 16 '13 22:10

metalaureate


People also ask

How does ng-bind-HTML work?

The AngularJS ng-bind-html directive is used to bind content to an HTML element securely. It evaluates the expressions and inserts the resulting HTML into the element in a secure way. By default, the resulting HTML content will be sanitized using the $sanitize service.

What is Ng tag in HTML?

Definition and Usage The ng-bind-html directive is a secure way of binding content to an HTML element. When you are letting AngularJS write HTML in your application, you should check the HTML for dangerous code. By including the "angular-sanitize.

What does ng bind mean?

Definition and Usage The ng-bind directive tells AngularJS to replace the content of an HTML element with the value of a given variable, or expression. If the value of the given variable, or expression, changes, the content of the specified HTML element will be changed as well.

What is $SCE in AngularJS?

Strict Contextual Escaping (SCE) is a mode in which AngularJS constrains bindings to only render trusted values. Its goal is to assist in writing code in a way that (a) is secure by default, and (b) makes auditing for security vulnerabilities such as XSS, clickjacking, etc. a lot easier.


1 Answers

Instead of declaring a function in your scope, as suggested by Alex, you can convert it to a simple filter :

angular.module('myApp')     .filter('to_trusted', ['$sce', function($sce){         return function(text) {             return $sce.trustAsHtml(text);         };     }]); 

Then you can use it like this :

<div ng-bind-html="preview_data.preview.embed.html | to_trusted"></div> 

And here is a working example : http://jsfiddle.net/leeroy/6j4Lg/1/

like image 58
Leeroy Brun Avatar answered Oct 01 '22 20:10

Leeroy Brun