What is the difference between Renderer
and ElementRef
? In Angular both are used for DOM Manipulation. I am currently using ElementRef
alone for writing Angular 2 directives. If I get more info about Renderer
, I can use that in my future directives.
The Renderer
is a class that is a partial abstraction over the DOM.
Using the Renderer
for manipulating the DOM doesn't break server-side rendering or Web Workers (where direct access to the DOM would break).
ElementRef
is a class that can hold a reference to a DOM element.
This is again an abstraction to not break in environments where the browsers DOM isn't actually available.
If ElementRef
is injected to a component, the injected instance is a reference to the host element of the current component.
There are other ways to acquire an ElementRef
instance like @ViewChild()
, @ViewChildren()
, @ContentChild()
, @ContentChildren()
. In this case ElementRef
is a reference to the matching element(s) in the template or children.
Renderer
and ElementRef
are not "either this or that", but instead they have to be used together to get full platform abstraction.
Renderer
acts on the DOM and ElementRef
is a reference to an element in the DOM the Renderer
acts on.
renderer
just took ElementRef
but they changed it later. I think in platforms like Universal
ElementRef.nativeElement
doesn't actually refer to a DOM element. If you check angular.io/docs/ts/latest/api/core/index/ElementRef-class.html you'll see that nativeElement
is of type any
instead of HTMLElement
–
Mamiemamma nativeElement
can refer to platform specific elements, but passing elementRef instead of elementRef.nativeElement is still a higher abstraction and would work any way –
Grassi Do notice that you should refrain from using ElementHref as it flagged with a security risk.
Angular 2 Documentation:
"Permitting direct access to the DOM can make your application more vulnerable to XSS attacks. Carefully review any use of ElementRef in your code. For more detail, see the Security Guide."
"Use this API as the last resort when direct access to DOM is needed. Use templating and data-binding provided by Angular instead. Alternatively you take a look at Renderer which provides API that can safely be used even when direct access to native elements is not supported."
ElementRef
itself doesn't do any harm. The culprit is ElementRef.nativeElement
. This is IMHO (I'm all but a security expert) only security relevant if user provided data is used to add to the DOM, right? –
Mamiemamma © 2022 - 2024 — McMap. All rights reserved.
elementRef.nativeElement
instead of working withelementRef
likeviewContainerRef
. This seems to be a bit inconsistent. Any ideas? – Grassi