0

I'm writing an application which shows several different kind of devices in a single page and loads external templates depending on the device type.

Users will be able to submit custom templates, so I need to sanitize them.

Currently I'm using ng-repeat with a custom directive to show the devices, which makes use of:

template: '<ng-include src="getTemplateUrl()"></ng-include>'

scope.getTemplateUrl() is a function which I declared inside of the directive's link function which returns an URL depending on the device type.

It works flawlessly, but as I said I need to sanitize the URL content.

Unfortunately ng-bind-html wants an expression and not an URL, so the following will not work:

template: '<div ng-bind-html="getTemplateUrl()"/></div>'

I would like to avoid messing with async operations like $http inside my directive, so I cannot simply get the URL content and I don't know how could I use $sanitize directly without first retrieving the url content.

||||||
  • check out, ng-bind-html – Maher Jan 20 '16 at 10:57
  • 1
    Did you even read my question? :( – darkbasic Jan 20 '16 at 11:01
  • lol, can you please insert your codes? – Maher Jan 20 '16 at 11:06
  • With ng-bind-html it displays "templates/sensorGeneric.html" which is the URL, not the content. What do you mean? – darkbasic Jan 20 '16 at 11:13
0

Use $sce from ngSanitize module inside your directive function:

scope.getTemplateUrl = function() {
  return $sce.trustAsHtml(value);
};

Or use a filter to do something like this:

ng-bind-html="getTemplateUrl() | sanitizedHtml"

More information about sanitize here: https://docs.angularjs.org/api/ngSanitize/service/$sanitize

||||||
  • The are two flaws in your answer: 1) You are explicitely trusting a content, but I want the opposite. In fact if I wanted to simply show a trusted content ng-include already does the job. On the contrary the content should not be trusted and I want to sanitize it. 2) You're working with an expression, while I want to work with an URL. – darkbasic Jan 20 '16 at 11:36
  • Just to be clear I want to sanitize the content of my url, in fact the url points to my expression with not-to-be-trusted html. – darkbasic Jan 20 '16 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.