sanitizing unsafe URL value javascript

Question

Angular 2 final release.

I have my link as following with refers to the href="javascript:;" my link

and i am getting following warning

WARNING: sanitizing unsafe URL value javascript:; (see http://g.co/ng/security#xss)

I need my link to be javascript:; because if i make it '#' or '' it refreshes the page.

I have read couple of posts where people report this issue to angular folks and they will fix it.. any help is appreciated.

What's the purpose of having a link with dummy href in your case? Most likely you have XY problem with javascript:;. — Estus Flask
– Estus Flask, Commented Sep 21, 2016 at 20:44
ng-bootstrap dropdown main href we gotta keep it empty and have its drop down items. if we don't keep it javascripot:; and click it refreshes itself. — d-man
– d-man, Commented Sep 21, 2016 at 20:47
i am generating elements dynamically. they can have direct links or drop downs. if they link i use url to populate in href. if they drop down i make href as void(0); so clicking on it should not refresh the page. — d-man
– d-man, Commented Sep 21, 2016 at 20:53
You can have <a> without href or have <a href=...> with preventDefault() or have any other inline element with click event. So yes, this is likely XY problem, and you're trying to solve it the hard way. Please, provide the details for the underlying problem in the question. — Estus Flask
– Estus Flask, Commented Sep 21, 2016 at 21:33

d-man · Accepted Answer · 2016-09-22 14:18:52Z

1

done with the help of pkozlowski-opensource

I don't think you want to trick sanitization here. If you are using a link that has a click event and it shouldn't trigger navigation just prevent default action on the event, ex.:

<a (click)="$event.preventDefault(); doSth()"> or even shorter
<a (click)="!!doSth()">

reference post https://github.com/angular/angular/issues/11805#issuecomment-248840338

i simply removed href and added a click event like as following

<a (click)="!!navigateToUrl(urlVar)">..</a>

Note: '!!' prevent triggering 'href' action and prevent page refresh. navigateToUrl is my js method simply i am doing as

if(urlVar){
window.location.href=urlVar
}

works like charm no warnings etc..

answered Sep 22, 2016 at 14:18

d-man

58.2k86 gold badges216 silver badges299 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

sanitizing unsafe URL value javascript

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related