angular - 在 Angular 5 中使用 [innerHTML] 安全吗？

Question

我看到过相互矛盾的报告，即在 Angular2+ 中使用 [innerHTML] 标签是危险的。情况仍然如此还是已经修复？

例如这段代码是否危险:

<div [innerHTML]="post.body"></div>

Answer 1

如 here 中所述(在 Angular 网站本身)，看起来没有什么后顾之忧，因为 Angular 会自动识别不安全的值并对其进行清理。

这是里面写的:

Interpolated content is always escaped—the HTML isn't interpreted and the browser displays angle brackets in the element's text content.

For the HTML to be interpreted, bind it to an HTML property such as innerHTML. But binding a value that an attacker might control into innerHTML normally causes an XSS vulnerability. For example, the code contained in a <script> tag is executed:

export class InnerHtmlBindingComponent {
// For example, a user/attacker-controlled value from a URL.
htmlSnippet = 'Template <script>alert("0wned")</script> <b>Syntax</b>';
}

Angular recognizes the value as unsafe and automatically sanitizes it, which removes the <script> tag but keeps safe content such as the text content of the <script> tag and the <b> element.

所以我认为，是的，它是安全的。