CODEWITHSUNDEEP
angularescapingsanitizationurl-parametersquery-string
Martijn van den Bergh
Martijn van den Bergh

Reputation: 1554

Angular 4 Sanitizing/escaping query parameters

How do i securely use any query parameters that i receive? I have read about DOM sanitizing in Angular 4, but i can't find anything about securely using query parameters in angular 4.

Example:

https://www.myangularproject.com/?parameter1=value

I want to avoid that people inject there own code or scripts as value

Upvotes: 2

Views: 2063

Answers (1)

Armen Vardanyan
Armen Vardanyan

Reputation: 3315

Make sure that the parameter can be securely casted to the type of data that you expect it to be (if you expect a number, make sure '+queryParam' is not NaN, and so on), never use eval on data from the queryParams. You can be rest assured about putting queryParams values inside the DOM, as it is being sanitized by Angular before interpolating it to the view. This, I think, should do.

Upvotes: 1

Related Questions