1

I have a angular js page, in which I get a javascript generated dynamically from backend. The content is as follows

<script type='text/javascript' language='JavaScript' src='https://secure.echosign.com/public/widget?f=XXX'></script>

My HTML

<div ng-bind-html="htmlString"></div>

My Controller

    $scope.init = function () {
        $scope.initForm({
            action: $attrs.action

        }, function (data) {
            $scope.htmlString = "<html><h3>so Here it is</h3>" + $scope.model.htmlScript + "</html>";
        });
    };    

However when the page is rendered, the javascript tags are filtered out and the rest is displayed. Please suggest how I can proceed?

2 Answers 2

1

Angular.js has a service called $sce (Strict Contextual Escaping) which automatically uses $sanitize on directives like ng-bind-html. If you wish to override the escaping, you need to hook into the $sce service and explicitly trust your strings.

NOTE

This is generally not a recommended method to handle arbitrary HTML that can come from non-trusted sources, as it can open your site up to exploits.

$scope.htmlString = $sce.trustAsHtml(
     "<html><h3>so Here it is</h3>" + $scope.model.htmlScript + "</html>");
Sign up to request clarification or add additional context in comments.

8 Comments

thanks for pointers. Still I couldn't get it working. Following is the plunker URL plnkr.co/edit/vhOvLS0qrUxKmtNq4LUj?p=preview
I looked at the plunker, and I can see the script is emitted by document.write and is being retrieved by the server... without knowing what the script is I can't tell what else should happen?
were you wanting the HTML to be printed on the screen or were you wanting the script injected into your page?
the script is generated & provided by Adobe EchoSign through a REST API. All they provide is the following <script type="text/javascript" language="JavaScript" src="secure.echosign.com/public/…>. To view it normally, I wrap it in html tags and I am able to see it in browser.
so I still fail to understand what is going wrong at this point. Based on your plunker, you are using ng-bind-html, which inserts the string as inner html. If you do not use $sce, nothing is emitted, as the script is not trusted. If you do use $sce, the string is emitted, and the script is parsed. If you actually want to print it out, then it prints when using ng-bind.
|
0

Is there anyway you can inject the JS with a script tag at startup? I do some similar kinds of things where I create a URL that calls a django view and that views is returned as javascript. In the html it looks like this:

<script src="app/generated.js"></script>

And I simply return a valid piece of javascript from the server. Since it comes over as a script tag, the browser has no idea it was generated. It's how I handle user specific customization.

In my django app, I return the response as content type 'application/javascript'

Given this kind of example, you could simply inject a <script> tag into the page at a later point.

And the details: (Since I don't know the platform you are using, I'll do it in django which I feel is very readable.)

In Django, you have functions that are mapped to urls like this:

urls.py

url(r'^generated.js$', generate_javascript, name="generate-custom-js")

This line will cause the function generate_javascript to run if that URL is requested from the server. In that function, I authenticate the user, and lookup some things from the database. then I render the javascript for this customer via a template.

views.py

@login_required
def generate_javascript(request):
    previous_scores = Scores.objects.get(user=request.user).order_by('-date_recorded')[0:10]
    return render(request, 'generate.tpl.js', locals(), content_type='application/javascript')

Then you complete the template like this:

generate.tpl.js

var scores = [ 
{% for score in scores %}
     {{ score.number }}{% if not forloop.last %},{%endif %}
{% endfor %}
];

When rendered, this template generates a "file" that looks like:

var scores = [
    1,
    2,
    3,
    4,
    5
];

It's not the prettiest javascript you'll ever write, but it will parse and the browser doesn't care what it looks like.

Then in your index.html you have a line like

<script src="generated.js"></script>

1 Comment

Could you please provide an example. I am unable to visualize your solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.