DomSanitizer should keep style attributes in HTML, but sanitize them if needed
See original GitHub issueI’m submitting a…
[ ] Regression (a behavior that used to work and stopped working in a new release)
[ ] Bug report
[ x ] Feature request
[ ] Documentation issue or request
[ ] Support request => Please do not submit support request here, instead see https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question
Current behavior
DOM sanitizer removes style attribute from all elements.
Expected behavior
DOM santitizer keeps the style attribute on elements, but sanitizes the actual style value if needed, so something innocuous like style="text-align: center"
isn’t lost.
Minimal reproduction of the problem with instructions
http://plnkr.co/edit/AjJMr2pDz8IxvucnpTbC?p=preview
What is the motivation / use case for changing the behavior?
Displaying blog posts or other CMS content which uses inline styles for layout/styling.
Environment
Angular version: 4.3.6
Issue Analytics
- State:
- Created 6 years ago
- Reactions:65
- Comments:6 (2 by maintainers)
Top Results From Across the Web
Angular sanitize html but leave inline style - Stack Overflow
First of all my needs: I am using ngx-markdown but I needed some customization, which involved the need to add some simple style...
Read more >Safe DOM manipulation with the Sanitizer API - web.dev
To sanitize correctly, it is necessary to parse the input string as HTML, omit tags and attributes that are considered harmful, and keep...
Read more >Using Angular innerHtml to display user-generated content ...
As an example, Take a look at the source for DomSanitizer that shows what HTML attributes are "whitelisted". I have both <style> tags...
Read more >«WARNING: sanitizing HTML stripped some content» and ...
Everyone who has ever had a need to inline HTML into DOM in Angular have seen ... We would need to run it...
Read more >Angular 2 Security — The DomSanitizer Service - Netanel Basal
Behind the scenes, Angular will sanitize the HTML input and escape the unsafe code, so in this case, the script will not run,...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Totally relevant because the only way to allow styles at the moment is to entirely trust the input. The use case for this is displaying user input from a rich text editor. I want to strip any dangerous bits about javascript, resourceURL and the such but keep the style attributes intact.
@jessicajaniuk Updated the angular to the latest stable version which is now 13.2.5 and still have the issue - DomSanitizer still removes the style attr from html element in SecurityContext.HTML, so opening a new issue.