Sicheres Umgehen von vertrauenswürdigen Ressourcen-URLs mit dem Angular DomSanitizer

import { Component, inject } from '@angular/core';
import { DomSanitizer, SafeResourceUrl } from '@angular/platform-browser';
 
@Component({
  selector: 'app-video-frame',
  template: `<iframe [src]="trustedUrl" width="560" height="315"></iframe>`
})
export class VideoFrameComponent {
  private readonly sanitizer = inject(DomSanitizer);
  public trustedUrl: SafeResourceUrl | null = null;
 
  public setVideoSource(rawVideoId: string): void {
    const sanitizedId = encodeURIComponent(rawVideoId.trim());
    const targetUrl = `https://www.youtube-nocookie.com/embed/${sanitizedId}`;
    this.trustedUrl = this.sanitizer.bypassSecurityTrustResourceUrl(targetUrl);
  }
}