InputSanitizerService
Structured input sanitization to defend against XSS, URL injection, and unsafe HTML. This is defense-in-depth and does NOT replace a Content Security Policy (CSP).
TypeScriptexample.ts
import { InputSanitizerService } from '@angular-helpers/security'# Methods
| Method | Signature | Returns | Description |
|---|---|---|---|
isSupported | isSupported(): boolean | boolean | Public method isSupported. |
sanitizeHtml | sanitizeHtml(input: string): string | string | Parses and sanitizes an HTML string, keeping only allowed tags and attributes. Leverages the native browser Sanitizer API (e.g. Element.prototype.setHTML) if available for high-performance execution, falling back to a custom DOMParser implementation on unsupported environments (such as older browsers or SSR). |
getTrustedHtml | getTrustedHtml(input: string): any | any | Returns a TrustedHTML object (or similar if using a polyfill) if the Trusted Types policy is available, otherwise returns the raw input string. |
sanitizeUrl | sanitizeUrl(input: string): string | null | string | null | Validates and normalizes a URL string. Returns the normalized URL only for `http:` and `https:` schemes. Returns `null` for `javascript:`, `data:`, `vbscript:`, relative URLs, or malformed input. |
escapeHtml | escapeHtml(input: string): string | string | Escapes HTML special characters for safe text interpolation. Use this when inserting user content into HTML text nodes or attributes. |
sanitizeJson | sanitizeJson(input: string): unknown | null | unknown | null | Safely parses a JSON string. Returns the parsed value on success, `null` on any error. Does NOT use `eval` or `Function` — uses JSON.parse only. |