angular/no-bypass-security-trust

Why

Angular sanitizes every value bound into [innerHTML], [href], [src] and [style]. bypassSecurityTrustHtml, …Url, …ResourceUrl, …Script and …Style switch that off for one value: if any part of it comes from a user, a URL or an API, it is cross-site scripting.

Fix

Bind the value without bypassing ([innerHTML]="html" is sanitized and keeps safe markup). Bypass only constants you wrote (an embed URL built from a fixed origin and a validated id), keep the call in one small function with a comment that says why it is safe, and never pass ElementRef.nativeElement.innerHTML raw strings either. Manual because the engine does not read .ts files: search for bypassSecurityTrust and review each call.

Examples

// bad
this.body = this.sanitizer.bypassSecurityTrustHtml(comment.html)
// good
body = computed(() => this.comment().html) // bound with [innerHTML], which sanitizes

Sources

• Angular, Security (trusting safe values)
• Angular API, DomSanitizer

Read it in the terminal

npx github:dawidolko/frontend-skills explain angular/no-bypass-security-trust