Angular & Signals (283 Qs)•Part 7: Change Detection, Security (XSS/Sanitizer) & Interceptors (151 - 176)
Is it safe to use direct DOM API methods in terms of security?
No,the built-in browser DOM APIs or methods don't automatically protect you from security vulnerabilities. In this case it is recommended to use Angular templates instead of directly interacting with DOM. If it is unavoidable then use the built-in Angular sanitization functions.
Practical Code Example
typescript
// Is it safe to use direct DOM APIs?
// NO! Direct DOM APIs (e.g. el.nativeElement.innerHTML = untrustedInput) bypass
// Angular's sanitization pipeline and expose the app to XSS vulnerabilities.