javascript / intermediate
Snippet
Sanitizing Potentially Malicious User Input via SecurityContext Evaluation
Angular treats all untrusted values as dangerous by default. Using DomSanitizer.sanitize along with a specific SecurityContext allows developers to scrub malicious HTML strings programmatically, stripping out script tags and insecure attributes before processing.
snippet.js
javascript
1
2
3
4
5
6
7
8
9
10
11
12
import { Injectable, SecurityContext } from '@angular/core';import { DomSanitizer } from '@angular/platform-browser';@Injectable({ providedIn: 'root' })export class HtmlSanitizerService {constructor(private sanitizer: DomSanitizer) {}cleanHtml(rawContent: string): string {const sanitized = this.sanitizer.sanitize(SecurityContext.HTML, rawContent);return sanitized ?? '';}}
angular
Breakdown
1
constructor(private sanitizer: DomSanitizer) {}
Injects Angular's built-in DomSanitizer service to handle context-aware security parsing.
2
cleanHtml(rawContent: string): string {
Declares a helper method taking an untrusted raw string and returning safe text.
3
const sanitized = this.sanitizer.sanitize(SecurityContext.HTML, rawContent);
Applies HTML context sanitization to remove malicious tokens and tags.
4
return sanitized ?? '';
Returns the clean string or an empty fallback if sanitization stripped all content.