Qfyilyi

I want to create an example of xss attack, with angular 7, for teaching purposes.

<div class="container mt-3">

<div class="row">

    <div class="col-12">

        <ul>

            <li *ngFor="let message of messages">{{message}}</li>

            <li *ngFor="let message of messages" [innerHTML]="message"></li>

            <li *ngFor="let message of messages" [innerHTML]="message | keepHtml"></li>

        </ul>

        <ng-container *ngIf="messages.length === 0">No messages</ng-container>

    </div>

    <div class="col-12">

        <hr/>

        <label>New Message</label>

        <textarea class="form-control" [(ngModel)]="model.message" name="message"></textarea>

        <button class="btn btn-success mt-2" (click)="submit()">Send Message</button>

    </div>

</div>

Pipe

import { Pipe, PipeTransform } from '@angular/core';

import { DomSanitizer } from '@angular/platform-browser';



@Pipe({ name: 'keepHtml', pure: false })

export class EscapeHtmlPipe implements PipeTransform {

    constructor(private sanitizer: DomSanitizer) {

    }



    transform(content) {

        return this.sanitizer.bypassSecurityTrustHtml(content);

    }

}

I want to send message <script>alert('1');</script> and let the alert run