Repository navigation
DomSanitizer should keep style attributes in HTML, but sanitize them if needed #19645
Description
I'm submitting a...
[ ] Regression (a behavior that used to work and stopped working in a new release)
[ ] Bug report
[ x ] Feature request
[ ] Documentation issue or request
[ ] Support request => Please do not submit support request here, instead see https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question
Current behavior
DOM sanitizer removes style attribute from all elements.
Expected behavior
DOM santitizer keeps the style attribute on elements, but sanitizes the actual style value if needed, so something innocuous like style="text-align: center" isn't lost.
Minimal reproduction of the problem with instructions
http://plnkr.co/edit/AjJMr2pDz8IxvucnpTbC?p=preview
What is the motivation / use case for changing the behavior?
Displaying blog posts or other CMS content which uses inline styles for layout/styling.
Environment
Angular version: 4.3.6
Reacted by WalletHub, hippotz, Krzysztof Furmann, davidmdrayton, Dhaya, Sven Habex, Jack Tomaszewski, michael-x, Jahrenski, Trotyl Yu and 55 more
Activity
Jahrenski commentedon Apr 24, 2018
Totally relevant because the only way to allow styles at the moment is to entirely trust the input.
The use case for this is displaying user input from a rich text editor.
I want to strip any dangerous bits about javascript, resourceURL and the such but keep the style attributes intact.
waterplea commentedon Mar 4, 2019
Just hit the same thing working on a WYSIWYG. Native execCommands for justification and highlight colors add styles for background color and for text-align but these styles are removed by sanitation. Would be great to have sanitizer remove only dangerous stuff!
Vandivier commentedon May 1, 2020
Please take a look at the following, and consider upvoting, as a generic solution for this and other similar problems:
#36650
but sanitize them if neededcould specifically be solved by using atrustAttributeI suggest in the above issue.jessicajaniuk commentedon Feb 15, 2022
Thanks for reporting this issue. This issue is now obsolete due to changes in the recent releases. Please update to the most recent Angular version.
If the problem still exists in your application, please open a new issue and follow the instructions in the issue template.
amaestr0 commentedon Mar 4, 2022
@jessicajaniuk Updated the angular to the latest stable version which is now 13.2.5 and still have the issue - DomSanitizer still removes the style attr from html element in SecurityContext.HTML, so opening a new issue.
angular-automatic-lock-bot commentedon Apr 4, 2022
This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.
Read more about our automatic conversation locking policy.
This action has been performed automatically by a bot.