4

An angularjs application stores user input to local/sessionStorage and retrieves it later to fill the form fields or display that content later. If a javascript is submitted as user input, it gets stored in the web storage and is displayed back as required, but it doesn't get executed. I assume that angularjs does some type of output encoding while displaying the content back.

I have tried,

  1. To use view source in browser, but it shows expression before it is compiled
  2. Use inspector in Chrome - It displays the input as is.
  3. Proxy like Fiddler - Wont help much since not request is made.

How do I see what browser actually renders? Or how do I intercept the user data before it is compiled.

P.S. I only have a very basic idea on AngularJS.

EDIT: This question is specific to web application security. I injected an XSS script and it is 'displayed' back as text. Now I need to verify if it is encoded or not. Three options mentioned about does not help.

3

AngularJS Batarang seems to be the tool you might be looking for. It's a Chrome Developer Tools extension that adds support for debugging and profiling AngularJS applications.

Other than that, you could also inspect values the standard way by accessing DOM element values by JavaScript. It might be a bit tricky to get a pointer to the exact element in question, so the easiest would be (for basic debugging purposes) to simply add to the element an ID and then access it that way. It would work in the Watch Expressions in Sources tab in Chrome Developer Tools too, but does not update on its own each time the value changes, so you could set an Event Listener Breakpoint (depends on the event type you're after) and refresh values this way in the debugger. If however you'd like to trap AngularJS own event listeners (replace existing ones, or also create new ones) then this thread on StackOverflow should have you covered (the answer for your use case is in the question itself).

But, the AngularJS Batarang is a lot more convenient, so no need to reinvent the wheel here. I'm not saying that you would, I'm saying that I actually did, before discovering the extension myself. Anyway, hope any of this helps ;)

  • Had installed this addon couple of days back but never checked it properly :) Looks like I should give that a shot. – rajivvishwa May 7 '13 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.