Migrating ngSanitize ($sanitize, ng-bind-html, linky) to modern Angular
ngSanitize provided $sanitize, made ng-bind-html safe and included the linky filter, which turned URLs in text into links.
What replaces it
| Option | When to choose it |
|---|---|
| Built-in sanitization with [innerHTML] | No package needed: Angular sanitizes HTML bound to innerHTML by default. |
| DOMPurify | When you must control the list of allowed tags and attributes, for example for rich editor content. |
| A small pipe for links | linky has no built-in equivalent; write a pipe that builds the links and let Angular sanitize the result. |
How to migrate it
- Replace ng-bind-html with [innerHTML]; Angular sanitizes the value automatically.
- Review every $sce.trustAsHtml call: most should become plain sanitized bindings, and only content you fully control may use bypassSecurityTrustHtml.
- Replace linky with a pipe of your own and test it with untrusted input.
Watch out. The two sanitizers do not allow exactly the same markup; Angular strips inline style attributes, for example. Render stored content with both and compare, and watch the console warning Angular logs in development when it removes something.
Other libraries
Planning a migration or a micro-frontend platform?
In a 20-minute call you describe your situation and I tell you how I'd approach it. If it isn't worth doing yet, I'll say so.
Message me on LinkedIn