Collected research
XSS without HTML: Client-Side Template Injection with AngularJS
Pages that reflect user input into an AngularJS template can be attacked with double-curly expressions even when the input is HTML-encoded, because Angular evaluates them after encoding. Overwriting a native function such as charAt with Array join corrupts Angular's own parser, escaping the expression sandbox and running arbitrary JavaScript.
Record
- Researcher
- Gareth Heyes
- Published by
- PortSwigger Research
- Date
- Topic
- XSS
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .