Support for AngularJS aHrefSanitizationTrustedUrlList feature

I can’t find a way to port the feature we have in our AngularJS to our Angular app:

https://docs.angularjs.org/api/ng/provider/$compileProvider#aHrefSanitizationTrustedUrlList

If i google around they all say use the https://angular.io/api/platform-browser/DomSanitizer but thats not the same, As far as i can see that only tells us that we want to trust more (possible unsafe stuff) But we want the other way around we want to be more stricter if sanitize happens… If we have a following html template:

<span>hello</span><a href="https://evil.com">My Nice Link</a><span>please click</span>

And i place that on an Angular component that displays that html Then i want that angular makes it:

<span>hello</span><a href="unsafe:https://evil.com">My Nice Link</a><span>please click</span>

or something like that, in AngularJS it just fully removes the href attribute if i i set an allowed/trusted url list. (which doesnt include evil.com)

But no matter where i look that just isn’t possible right now? it seems only if i do:

<span>hello</span><a href="javascript:xxxx">My Nice Link</a><span>please click</span>

angular makes it

<span>hello</span><a href=""unsafe:javascript:xxxx">My Nice Link</a><span>please click</span>

I would love to have a hook that after the current Angular implementation says i don’t do anything with that url that i can still say no this is also unsafe.

[petebacondarwin]

While one ought to be able to override the DomSanitizer with your own implementation, I don’t quite see how we can do this with Ivy code, since it doesn’t rely upon the DI to get the sanitizer implementation. See https://stackblitz.com/edit/angular-ivy-n9a6jc?file=src%2Fapp%2Fapp.module.ts

[angular-automatic-lock-bot[bot]]

This issue has been automatically locked due to inactivity. Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}