How to undo bypassSecurityTrustHtml, i.e convert SafeValue back to string

Question

I am generating html, and inserting it into my web page using

let data = '<font color=blue>hello world</font>';
this.safevalue = this.domSanitizer.bypassSecurityTrustHtml(data);

Elsewhere in my code I want to convert the safe value back into a string, so I tried this...

data = this.safevalue.toString();

but this sets data to a string like this...

'SafeValue must use [property]=binding: (see http://g.co/ng/security#xss)'

which is not helpful

Subway

What do you get with console.log(this.safevalue)? – Jaine

@GünterZöchbauer I get the same thing as toString. – Subway

Answer 1

I don't know if you already found a fix for this, but, if you just want the original value, marked as safe:

var yourString = this.domSanitizer.sanitize(SecurityContext.HTML, data)

Libratory

Does this work? If the data is "Hello world" then will the value of yourString.toString() be also "Hello world"? – Subway

Yes, it does. That's how I am doing in my application here. Give it a try and let me know if you need any help! You just have to use yourString (no need for .toString(), it is a slready a string) – Libratory

Answer 2

I've dug through the source code and it appears that it is not possible to get the original string from a SafeValue. So I guess I'll have to keep parallel data array for all the unsafe values.

Subway