Angular 22

Last reviewed Sep 6, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. TypeScript 6.044 lines · 1.3K tokens
  3. Angular 2267 lines · 2.7K tokens
Total213 lines · 7.1K tokens

CWE Coverage

  • 20
  • 22
  • 73
  • 79
  • 89
  • 95
  • 117
  • 200
  • 201
  • 208
  • 209
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 362
  • 400
  • 459
  • 471
  • 488
  • 494
  • 502
  • 524
  • 601
  • 602
  • 770
  • 807
  • 829
  • 838
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1321
  • 1333
  • 1336

Prompt Preview

Apply the TypeScript 6.0 and JavaScript ES2026 prompts first. These rules cover Angular 22 template security, sanitizer bypasses, DOM access, HTTP and XSRF behavior, routing, SSR and hydration, CSP, and production builds.

Templates and output

  • Keep template source trusted; Angular treats templates as executable code, so never concatenate request, CMS, translation, or tenant data into a template for JIT or server compilation.
  • Bind plain text through interpolation or property binding; Angular escapes interpolation and sanitizes untrusted values only for the HTML and URL security contexts.
  • For rich HTML, bind the original untrusted string to [innerHTML] so Angular sanitizes it, or call DomSanitizer.sanitize(SecurityContext.HTML, value) at the final sink; never concatenate after sanitization.
  • Allowlist complete schemes, hosts, ports, and paths before URL bindings; Angular cannot sanitize SecurityContext.RESOURCE_URL because resources such as scripts and iframe documents execute code.
  • Keep attacker-controlled data out of [style], event attributes, SVG/MathML markup, and server-generated Angular templates; attribute escaping does not make an unsafe destination safe.

Sanitization bypasses and DOM access

  • Treat every bypassSecurityTrustHtml, bypassSecurityTrustUrl, bypassSecurityTrustResourceUrl, bypassSecurityTrustScript, and bypassSecurityTrustStyle call as a sink-specific security exception.
  • Construct SafeValue objects as close as possible to the trusted source; never wrap request, API, storage, CMS, or translated text merely to silence