Angular2 innerHtml removes styling

Question

I am using innerHtml and set the html in my cms the response seems okay and if I print it like this: {{ poi.content }}

it gives me the right content back : `

<table border="0" cellpadding="5" cellspacing="0">
   <tbody>
     <tr>
       <td style="vertical-align: top;">Tes11t</td>
       <td style="width: 2px;">&nbsp;</td>
       <td style="width: 1px;"><img alt="midgetgolf-sport-faciliteiten-vakantiepark-2.jpg" src="http://beeksebergen.dev/app_dev.php/media/cache/resolve/full_size/midgetgolf-sport-faciliteiten-vakantiepark-2.jpg" style="height: 67px; width: 100px;" /></td>
      </tr>
    </tbody>
 </table>

`

But when I use [innerHtml]="poi.content" it gives me this html back:

<table border="0" cellpadding="5" cellspacing="0">
    <tbody>
        <tr>
            <td>Tes11t</td>
            <td>&nbsp;</td>
            <td><img alt="midgetgolf-sport-faciliteiten-vakantiepark-2.jpg" src="http://beeksebergen.dev/app_dev.php/media/cache/resolve/full_size/midgetgolf-sport-faciliteiten-vakantiepark-2.jpg"></td>
        </tr>
    </tbody>
</table>

Does anybody know why it is stripping my styling when I use [innerHtml]

Lethe

This looks like pretty similar: #36265526 – Agamic

Answer 1

Angular2 sanitizes dynamically added HTML, styles, ...

import { Pipe } from '@angular/core';
import { DomSanitizer } from '@angular/platform-browser';

@Pipe({name: 'safeHtml'})
export class SafeHtmlPipe {
  constructor(private sanitizer: DomSanitizer){}
    
  transform(html: string) {
    return this.sanitizer.bypassSecurityTrustHtml(html);
  }
}

[innerHtml]="poi.content | safeHtml"

See

• https://angular.io/docs/ts/latest/api/platform-browser/index/DomSanitizer-class.html
• In RC.1 some styles can't be added using binding syntax for more details.

Anomalism

unhandled promise rejection: EXCEPTION: Can't resolve all parameters for Safe: (?). platform-browser.umd.js:2347 EXCEPTION: Can't resolve all parameters for Safe: (?).BrowserDomAdapter.logError also can't find name DomSanitizer – Lethe

Do I have to import import DomSanitizer? – Lethe

Yes, you have to import every type you use. You also need to add Safe to declarations in NgModule. If DomSanitizer doesn't work, try changing it to Sanitizer. I have seen it mentioned that this worked instead. – Sino

like this import {DomSanitizationService} from '@angular/platform-browser';? or is it DomSanitizer? Because DomSanitizer isnt recognisble – Lethe

DomSanitizationService is an old RC.x name. In final it's DomSanitizer or Sanitizer. – Sino

Thanks it is working I have to update my angular because in my case I use DomSanitizationService – Lethe

That was super awesome solution. Make a pipe and use it anywhere. – Spurgeon

I am using your solution but it is giving me error that "The pipe 'safeHtml' could not be found". How can I solved that ? @GünterZöchbauer – Phototype

my code import { Component,Pipe } from '@angular/core'; import { DomSanitizer } from '@angular/platform-browser'; @Pipe({name: 'safeHtml'}) @Component({ selector: 'page-article', templateUrl: 'news-article.html' }) export class Article { constructor(private sanitizer:DomSanitizer) {} transform(html) { return this.sanitizer.bypassSecurityTrustHtml(html); } } – Phototype

It is mean't like "I (the developer) assure you (Angular) that I know what I'm doing and confirm thatbthe content is safe." It just adds a marker for Angular to know it should not meddle with the content. I don't claim this is the best possible name ;-) Suggestions welcome. – Sino