Angular 4 Sanitizing/escaping query parameters

Question

How do i securely use any query parameters that i receive? I have read about DOM sanitizing in Angular 4, but i can't find anything about securely using query parameters in angular 4.

Example:

https://www.myangularproject.com/?parameter1=value

I want to avoid that people inject there own code or scripts as value

Armen Vardanyan · Accepted Answer · 2017-12-01 11:12:18Z

1

Make sure that the parameter can be securely casted to the type of data that you expect it to be (if you expect a number, make sure '+queryParam' is not NaN, and so on), never use eval on data from the queryParams. You can be rest assured about putting queryParams values inside the DOM, as it is being sanitized by Angular before interpolating it to the view. This, I think, should do.

answered Dec 1, 2017 at 11:12

Armen Vardanyan

3,3251 gold badge16 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Martijn van den Bergh Over a year ago

Thanks for the answer. So you are saying that i should escape it myself and that there is no automatic Angular sanitation for query parameters? This wasn't clear in the docs of Angular, hence the question

Armen Vardanyan Over a year ago

There is no need in "sanitizing" it, just don't use eval on it and make sure to cast it to the expected type (because queryParams always emit strings). So essentially, yes, you do not have much work to do on this one

Collectives™ on Stack Overflow

Angular 4 Sanitizing/escaping query parameters

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related