InputSanitizerService

Structured input sanitization to defend against XSS, URL injection, and unsafe HTML. This is defense-in-depth and does NOT replace a Content Security Policy (CSP).

TypeScriptexample.ts
import { InputSanitizerService } from '@angular-helpers/security'

# Methods

MethodSignatureReturnsDescription
isSupportedisSupported(): booleanbooleanPublic method isSupported.
sanitizeHtmlsanitizeHtml(input: string): stringstringParses and sanitizes an HTML string, keeping only allowed tags and attributes. Leverages the native browser Sanitizer API (e.g. Element.prototype.setHTML) if available for high-performance execution, falling back to a custom DOMParser implementation on unsupported environments (such as older browsers or SSR).
getTrustedHtmlgetTrustedHtml(input: string): anyanyReturns a TrustedHTML object (or similar if using a polyfill) if the Trusted Types policy is available, otherwise returns the raw input string.
sanitizeUrlsanitizeUrl(input: string): string | nullstring | nullValidates and normalizes a URL string. Returns the normalized URL only for `http:` and `https:` schemes. Returns `null` for `javascript:`, `data:`, `vbscript:`, relative URLs, or malformed input.
escapeHtmlescapeHtml(input: string): stringstringEscapes HTML special characters for safe text interpolation. Use this when inserting user content into HTML text nodes or attributes.
sanitizeJsonsanitizeJson(input: string): unknown | nullunknown | nullSafely parses a JSON string. Returns the parsed value on success, `null` on any error. Does NOT use `eval` or `Function` — uses JSON.parse only.
LCP N/A
CLS N/A
INP N/A