confirm未对显示内容过滤防止xss攻击 about ng-zorro-antd

[zorro-bot]

Translation of this issue:

Confirm does not use the display content filtering to prevent XSS attacks

REPRODUCTION LINK

[https://ng-zorro-mtd- ivy-cjm9xv.stackblitz.io] (https://ng-zorro-ntd-Ivy-cjm9xv.stackblitz.io))))))))

STEPS To Reproduce

`` Text

Import {component} from '@angular/core';
import {nzmodalService} from 'ng-zorro -NTD/MODAL';

@component ({{
Selector: 'My-APP',
template: `
<input nz-input [(ngmodel)] = "input">

<Button
  (click) = "OpenConfirm ()" "
  nz-button
  Type = "Button"> Confirm </Button>

`,
})
export class appcomponent {
input = 'delete [ link ]?';

Constructionor (Private NzmodalService: NZMODALSERVICE) {}

OpenConfirm (): void {
this.nzmodalService.confirm ({
nztitle: this.input,
});
}
}
`` `

What is exfected?

The link cannot be clicked

What is actually happy?

Click the link to jump to the external website

| ENVIRONMENT | Info |
| --- | --- | |
| NG-Zorro-ATD | 17.4.0 |
| Browser | Chrome |