Angular DomSanitizer - SecurityContext.NONE

Question

Official Angular Security Guide speaks about 4 security contexts: HTML, Url, Style and Resource Url.
Each one is responsible for sanitizing corresponding type of resource.
In addition, there are 5 methods (per resource type) in DomSanitizer service

 - bypassSecurityTrustHtml 
 - bypassSecurityTrustScript
 - bypassSecurityTrustStyle 
 - bypassSecurityTrustUrl
 - bypassSecurityTrustResourceUrl

However, I didn't find any mention of SecurityContext.NONE in official documentation. And it's does exist in the code.

I would assume that it aggregates all the resource types, meaning the resource being sanitized can be HTML, which contains styling and scripts.

Is that the case? Any official source?

Corfu

Answer 1

Apparently, if we use domSanitizer.sanitize with SecurityContext.NONE, it won't perform any sanitation and will return the value as is.

Thus, this will allow HTML with embedded URLs, styling and scripts.

Therefore it is highly recommended not to use this in your code.

Corfu

They really could enhance their documentation... Terrible to not have this documented after all this time... – Titanomachy

That's... extremely scary. I'd assumed that "None" meant "Completely Untrusted", and it turns out it meant "Completely Trustworthy". – Patriarchate