Skip to content

Latest commit

 

History

History
7 lines (4 loc) · 619 Bytes

no-angularjs-enable-svg.md

File metadata and controls

7 lines (4 loc) · 619 Bytes

Do not enable SVG support in AngularJS (no-angularjs-enable-svg)

Calls to $sanitizeProvider.enableSvg(true) increase attack surface of the application by enabling SVG support in AngularJS sanitizer and need to be reviewed.

SVG support should be enabled only in very rare and justifiable cases after careful review so that the risk of introducing Clickjacking vulnerability is minimized.

See official documentation for more details about the issue.