Angular2: Use DomSanitizer with HTML and STYLE

Asked Jan 23 '18 at 03:48

Active Jan 24 '18 at 11:33

Viewed 872 times

I use angular 2.1.2, and I want to use sanitize method to prevent XSS/CSRF attacks.

I implemented: this.sanitizer.sanitize(SecurityContext.HTML, this.content)

The html file have html, style, javascript. So this method will unwrap the style and javascript.

But I just only want unwrap for javascript and skip html and style. So, any solution for me to implement this issue.

HTML before sanitation

<html>
  <head><style>h2 {color: #FFFF7C}</style>
    <script>alert("hi")</script>
    </head>
  <body>
    <h2>HTML Content</h2>
  </body>
</html>

Result after sanitation:

//HTML content: "&#10; h2 {color: #FFFF7C}&#10; alert(&#34;hi&#34;)&#10; &#10; &#10; <h2>HTML Content</h2>&#10; &#10;"

//HTML content view:
h2 {color: #FFFF7C} alert("hi")
HTML Content

Result expect:

alert("hi")
HTML Content //I expect this line will be applied the color: #FFFF7C

edited Jan 24 '18 at 11:33

asked Jan 23 '18 at 03:48

ThuyNguyen

1,127
3
14
24

what do you mean by `html, style, javascript`? show an example of HTML before sanitation and how you want it to look after sanitation – Max Koretskyi Jan 23 '18 at 06:24
@AngularInDepth.com, I just update my question, please view again, thanks – ThuyNguyen Jan 24 '18 at 04:12
_make this script doesn't work_ - `sanitize(SecurityContext.HTML` will just remove `` will be `alert("hi")`. It doesn't touch `style` tag. – Max Koretskyi Jan 24 '18 at 06:04
@AngularInDepth.com, currently the result is `" h2 {color: #FFFF7C} alert("hi")
HTML Content
"`. The `style` tag is also unwrap. I just update post. – ThuyNguyen Jan 24 '18 at 07:50
And I'm using angular 2.1.2 – ThuyNguyen Jan 24 '18 at 07:56
I see, add that information to the post, and Angular version as well – Max Koretskyi Jan 24 '18 at 10:53
@AngularInDepth.com, I updated, thanks. – ThuyNguyen Jan 24 '18 at 11:35
Any solution for me :( – ThuyNguyen Feb 02 '18 at 02:54
sorry, I'm not familiar how sanitizer works in v2. maybe create a demo and post it here – Max Koretskyi Feb 02 '18 at 06:01

Angular2: Use DomSanitizer with HTML and STYLE

HTML Content

0 Answers0