[Tooltip] Insecure HTML sanitize

Bug description:

Tooltip allows HTML content which is sanitized for most common code injections such as script tags. Documentation: https://ng-bootstrap.github.io/#/components/tooltip/examples#tplcontent

However, anchor tags with and external href link are still allowed!

Tooltip should escape such markup as it can impact users security and privacy.

Link to minimally-working StackBlitz that reproduces the issue:

StackBlitz: https://stackblitz.com/edit/angular-bqmpjp?file=app/tooltip-tplcontent.html

Versions of Angular, ng-bootstrap and Bootstrap:

Angular: 7.0.0

ng-bootstrap: 4.0.0

Steps to reproduce:

• Click on the button to open tooltip
• Click on the tooltip to open external web site.

[pkozlowski-opensource]

However, DomSanitizer can be bypassed by binding to innerHTML.

Depending on what you mean by “bypassed” - notice that in your stackblitz renders unsafe:javascript:alert('owned') which effectively prevents JS alert. This is exactly what happens with pure Angular (no ng-bootstrap involved): https://stackblitz.com/edit/angular-juy4wa?file=src%2Fapp%2Fapp.component.html

Again, we don’t do anything special here. What works (in the sense: " is sanitized") in Angular follows the same rules in ng-bootstrap.

[pkozlowski-opensource]

@mboughaba I think that there is some confusion going on about how sanitiser works.

Angular sanitiser will not sanitise static attributes (those written) in templates, see: https://stackblitz.com/edit/angular-w4v9es?file=src%2Fapp%2Fapp.component.html

The reason for this is simple - if an author of a template puts some code that is executing JS than we are assuming that this is the intention of the template author. If we can’t trust template / application authors that we would have to assume that those people are potential attackers and there is nothing Angular can do about it.

Angular will sanitise_ output from expressions as demonstrated in your stackblitz.

I still hold my ground - tooltip is using standard Angular templates and its sanitiation rules are not different as compared to any other Angular template. This is how we want it to be.

Does it make sense?