Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

$sanitize removes the tabindex property #5853

Closed
carpasse opened this issue Jan 17, 2014 · 2 comments
Closed

$sanitize removes the tabindex property #5853

carpasse opened this issue Jan 17, 2014 · 2 comments

Comments

@carpasse
Copy link

Hi guys

I am trying to sanitize some html with the $sanitize service of the ngSanitize module. Unfortuantely $sanitize removes the tabindex property so I can make the link "not fucusable".
so this piece of code:

$sanitize('<a ng-href="someUrl" tabindex="-1">go</a>')

will return

'<a href="someUrl">go</a>"

I have been searching a bit and I couldn´t find any security issue regarding the tabindex property so could it be possible to add this property to the list of valid attrs???

@Narretz Narretz added this to the Backlog milestone Jun 24, 2014
@chirag04
Copy link
Contributor

Seems like we need to add tabindex to uriAttr list here: https://github.com/chirag04/angular.js/blob/master/src/ngSanitize/sanitize.js#L207

@caitp If thats correct i am willing to send a PR.

@caitp
Copy link
Contributor

caitp commented Jul 25, 2014

Should probably go in validAttrs since it's useful for form controls too

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants