Skip to content

Instantly share code, notes, and snippets.

@siva-sundar
Last active January 18, 2016 14:03
Show Gist options
  • Save siva-sundar/98dc1bc97e4c73c23e96 to your computer and use it in GitHub Desktop.
Save siva-sundar/98dc1bc97e4c73c23e96 to your computer and use it in GitHub Desktop.
Ember security fix
import Ember from 'ember';
export default Ember.Controller.extend({
appName:'Ember Twiddle',
name: '',
display: Em.computed('name', function() {
return { name: Ember.String.htmlSafe(this.get('name')) } ;
})
});
<h1>Welcome to {{appName}}</h1>
<br>
<br>
Type `javascript:alert('hai')` as Input
<br>
<br>
{{input value=name}}
<br>
<br>
<a href={{display.name}}> Click me (with HTML safeString) </a>
<br>
<br>
<a href={{name}}> Click me (with Handlebars) </a>
{{outlet}}
<br>
<br>
{
"version": "0.5.0",
"EmberENV": {
"FEATURES": {}
},
"options": {
"enable-testing": false
},
"dependencies": {
"jquery": "https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.js",
"ember": "release",
"ember-data": "release",
"ember-template-compiler": "release"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment