Safely Bypassing Security Trust for Embedded Iframes via DomSanitizer

import { Pipe, PipeTransform, inject } from '@angular/core';
import { DomSanitizer, SafeResourceUrl } from '@angular/platform-browser';
 
@Pipe({
  name: 'safeMediaUrl',
  standalone: true
})
export class SafeMediaUrlPipe implements PipeTransform {
  private readonly sanitizer = inject(DomSanitizer);
  private readonly trustedOrigin = 'https://trusted-provider.example.com/';
 
  transform(rawUrl: string): SafeResourceUrl | null {
    if (!rawUrl || !rawUrl.startsWith(this.trustedOrigin)) {
      console.warn(`Untrusted media URL blocked: ${rawUrl}`);
      return null;
    }
    return this.sanitizer.bypassSecurityTrustResourceUrl(rawUrl);
  }
}