Package Exports

ember-purify

This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (ember-purify) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

Readme

Ember-purify

When you need to render user provided HTML content but don't want to trust the user content with Ember's Ember.String.htmlSafe or {{{ }}}. Uses DOMPurify to sanitize HTML & SVG. I strongly recommend you watch the video linked under the inspiration section. See XSS in action in Ember in this twiddle.

Inspiration

Securing your EmberJS Application talk By Philippe De Ryck.

Usage

{{purify-dom '<img src="missing-image.png" onerror=alert(1)//>'}}

will render

<img src="missing-image.png">

Details on DOMPurify, the underlying library can be found in its README

Configuration

To configure the purify helper globally in your app's config/environment.js,

ENV.APP.purify = {
  // Refer to various config options in DOMPurify's README
};

Installation

git clone <repository-url> this repository
cd ember-purify
npm install
bower install

Running

ember serve
Visit your app at http://localhost:4200.

Running Tests

npm test (Runs ember try:each to test your addon against multiple Ember versions)
ember test
ember test --server

Building

ember build

For more information on using ember-cli, visit http://ember-cli.com/.