no-angular-bypass-sanitizer

Disallow Angular DomSanitizer bypass APIs that trust unvalidated content.

Targeted pattern scope

This rule targets direct calls to Angular sanitizer bypass APIs such as:

• bypassSecurityTrustHtml(...)
• bypassSecurityTrustScript(...)
• related bypassSecurityTrust* methods.

What this rule reports

This rule reports code paths that mark untrusted input as safe using DomSanitizer bypass helpers.

Why this rule exists

Bypassing Angular sanitization can convert attacker-controlled input into trusted content and increase XSS risk.

❌ Incorrect

const trusted = sanitizer.bypassSecurityTrustHtml(userSuppliedHtml);
elementRef.nativeElement.innerHTML = trusted;

✅ Correct

const sanitizedHtml = sanitizer.sanitize(
 SecurityContext.HTML,
 userSuppliedHtml
);
elementRef.nativeElement.textContent = sanitizedHtml ?? "";

ESLint flat config example

import sdl from "eslint-plugin-sdl-2";

export default [
 {
  plugins: { sdl },
  rules: {
   "sdl/no-angular-bypass-sanitizer": "error",
  },
 },
];

When not to use it

Disable this rule only when a reviewed framework integration requires a trusted type flow and the source is strictly controlled.

Package documentation

• Rule source

Further reading

Rule catalog ID: R001

• Angular DomSanitizer security guidance
• Angular security guide