Reputation: 410
I have object JS was returned by AJAX. In this object there is field map
that contents JS code.
When I do: {{data.map.js}}
in template HTML, it gives me text instead working JS code.
This is code in template:
{{data.map.js}}
{{data.map.html}}
Object from response Ajax (short code):
map { html: "<div id="map_canvas" style="width:566px; height:310px;"></div>"
js: "↵ <script type="text/javascript">↵...}
Upvotes: 2
Views: 4367
Reputation: 21
Use this syntax for angular in html:
{{$on.constructor('alert(1)')()}}
This should work in regular html for ng-app
attribute
Upvotes: 2
Reputation: 1820
Angular documentation suggests you may be able to execute js code via eval(). I have not done this personally but take a look at https://docs.angularjs.org/guide/expression
Upvotes: 2