{"action":"created","issue":{"url":"https://api.github.com/repos/angular/angular/issues/12840","repository_url":"https://api.github.com/repos/angular/angular","labels_url":"https://api.github.com/repos/angular/angular/issues/12840/labels{/name}","comments_url":"https://api.github.com/repos/angular/angular/issues/12840/comments","events_url":"https://api.github.com/repos/angular/angular/issues/12840/events","html_url":"https://github.com/angular/angular/issues/12840","id":188932964,"number":12840,"title":"Allow customizing SAFE_URL_PATTERN in url_sanitizer.ts","user":{"login":"arg20","id":804281,"avatar_url":"https://avatars.githubusercontent.com/u/804281?v=3","gravatar_id":"","url":"https://api.github.com/users/arg20","html_url":"https://github.com/arg20","followers_url":"https://api.github.com/users/arg20/followers","following_url":"https://api.github.com/users/arg20/following{/other_user}","gists_url":"https://api.github.com/users/arg20/gists{/gist_id}","starred_url":"https://api.github.com/users/arg20/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arg20/subscriptions","organizations_url":"https://api.github.com/users/arg20/orgs","repos_url":"https://api.github.com/users/arg20/repos","events_url":"https://api.github.com/users/arg20/events{/privacy}","received_events_url":"https://api.github.com/users/arg20/received_events","type":"User","site_admin":false},"labels":[{"id":375525419,"url":"https://api.github.com/repos/angular/angular/labels/comp:%20security","name":"comp: security","color":"c7def8","default":false},{"id":130606848,"url":"https://api.github.com/repos/angular/angular/labels/type:%20RFC%20/%20discussion%20/%20question","name":"type: RFC / discussion / question","color":"EEEEEE","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-11-12T20:30:14Z","updated_at":"2016-12-07T16:41:57Z","closed_at":null,"body":"<!--\r\nIF YOU DON'T FILL OUT THE FOLLOWING INFORMATION WE MIGHT CLOSE YOUR ISSUE WITHOUT INVESTIGATING\r\n-->\r\n\r\n**I'm submitting a ...**  (check one with \"x\")\r\n```\r\n[ ] bug report => search github for a similar issue or PR before submitting\r\n[x] feature request\r\n[ ] support request => Please do not submit support request here, instead see https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question\r\n```\r\n\r\n**Current behavior**\r\nIt is not possible to customize which URLs are considered safe.\r\n\r\n**Expected behavior**\r\nA user could customize the REGEX used to match safe urls.\r\n\r\n**Minimal reproduction of the problem with instructions**\r\nN/A\r\n\r\n**What is the motivation / use case for changing the behavior?**\r\nWhen you are using ionic 2, Android will usually return URLs that begin with `content://`. Then you have to explicitly call `bypassSecurityTrustUrl` to be able to show them. In Angular 1 you could customize this by injecting `$compileProvider` and calling: `$compileProvider.imgSrcSanitizationWhitelist(/^\\s*(https?|ftp|file|blob|content):|data:image\\//);`. But there's no convenience alternative for angular 2.\r\n\r\n**Please tell us about your environment:**\r\nN/A\r\n\r\n* **Angular version:** 2.0.X\r\n2.2.0-rc.0\r\n\r\n* **Browser:** all\r\n \r\n* **Language:** all\r\n\r\n* **Node (for AoT issues):** `node --version` =   7.1.0\r\n"},"comment":{"url":"https://api.github.com/repos/angular/angular/issues/comments/265499574","html_url":"https://github.com/angular/angular/issues/12840#issuecomment-265499574","issue_url":"https://api.github.com/repos/angular/angular/issues/12840","id":265499574,"user":{"login":"rjamet","id":10632216,"avatar_url":"https://avatars.githubusercontent.com/u/10632216?v=3","gravatar_id":"","url":"https://api.github.com/users/rjamet","html_url":"https://github.com/rjamet","followers_url":"https://api.github.com/users/rjamet/followers","following_url":"https://api.github.com/users/rjamet/following{/other_user}","gists_url":"https://api.github.com/users/rjamet/gists{/gist_id}","starred_url":"https://api.github.com/users/rjamet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rjamet/subscriptions","organizations_url":"https://api.github.com/users/rjamet/orgs","repos_url":"https://api.github.com/users/rjamet/repos","events_url":"https://api.github.com/users/rjamet/events{/privacy}","received_events_url":"https://api.github.com/users/rjamet/received_events","type":"User","site_admin":false},"created_at":"2016-12-07T16:41:57Z","updated_at":"2016-12-07T16:41:57Z","body":"Hi ! sorry for the delay. Overall it looks fine to trust anything with these prefixes, our general type contract is \"URLs that are safe to go to\", which here means they cannot trigger unwanted actions. So content:// seem okay for security, and potentially the Windows Phone equivalent if it follows the same pattern.\r\n\r\nI don't like including them in the URL whitelist as default, since they don't make sense in most platforms, and I'm not sure either about exposing the URL sanitization whitelist for the global settings reason explained above. A config function triggering support could make sense, but it's a half measure and adding a few for each platform seems weird. \r\n\r\nHaving to use a pipe a few times is a little annoying, but on the other hand it seems to be the cleanest way of doing this in a misuse-resistant way, and providing that pipe in Angular or a mobile-centered module seems to make sense. It could also look at the current user agent and only trust the relevant schemes, maybe ?"}}
{"actor":{"display_login":"rjamet"}}