Angular 2+ Sanitize Form Input for XSS attacks

Question

I am developing a web application using Angular2 Beta.

My forms include simple Text fields and Text areas which accept input from the user and the data is displayed back in the application.

These fields are not meant to take any HTML input and render them back in HTML format.

I tried entering simple javascript code like

<script>alert("XSS");</script>

It is displayed as it is without running the malicious code. :)

I would like to check if my application is vulnerable to XSS attacks.

Does Angular 2+ sanitize the user inputs by default?

Daniel Gartmann · Accepted Answer · 2016-05-24 12:42:50Z

9

Yes it does! Angular2 provides a built-in, enabled by default, anti XSS protection named DomSanitizationService.

answered May 24, 2016 at 12:42

Daniel Gartmann

13.5k13 gold badges50 silver badges63 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1