-
-
Save MurhafSousli/3d2ddb777c8ce88e2400bd93f694cd3b to your computer and use it in GitHub Desktop.
import { Pipe, PipeTransform } from '@angular/core'; | |
import { DomSanitizer, SafeHtml } from '@angular/platform-browser'; | |
@Pipe({ | |
name: 'sanitizeHtml' | |
}) | |
export class HtmlSanitizerPipe implements PipeTransform { | |
constructor(private sanitizer: DomSanitizer) { | |
} | |
transform(value: string): SafeHtml { | |
return this.sanitizer.bypassSecurityTrustHtml(value); | |
} | |
} |
To anyone reading this - this pipe DOES NOT SANITIZE THE HTML! If the passed HTML contains script tags inserted by an attacker, you just got your site successfully attacked by XSS! What this pipe does is it tells Angular to trust the given value as safe, e.g. to not escape any <script> tags contained inside it for example. Only use this pipe when you are 100% sure that the input is safe! The
DomSanitizer
contains asanitize
function which can sanitize potentially dangerous HTML for you.The documentation for the
bypassSecurityTrustHtml
function has this to say:**WARNING:** calling this method with untrusted user data exposes your application to XSS security risks!
.
I was crazy here seeing that nobody pointed that out.
This is not a sanitization pipe! It is a bypass!
Angular service calls the service that bypass the content DomSanitizer
, assuming you know what you're doing! the gist name was just a short name for a pipe that uses the DomSanitizer
to bypass html content.
To anyone reading this - this pipe DOES NOT SANITIZE THE HTML! If the passed HTML contains script tags inserted by an attacker, you just got your site successfully attacked by XSS! What this pipe does is it tells Angular to trust the given value as safe, e.g. to not escape any <script> tags contained inside it for example. Only use this pipe when you are 100% sure that the input is safe! The
DomSanitizer
contains asanitize
function which can sanitize potentially dangerous HTML for you.The documentation for the
bypassSecurityTrustHtml
function has this to say:**WARNING:** calling this method with untrusted user data exposes your application to XSS security risks!
.