Angular · Senior · Question 34 of 75
When is DomSanitizer.bypassSecurityTrustHtml() dangerous?
- ✓Correct answer: When the value contains anything controlled by users - it disables sanitization and enables XSS
- 2Never; it only skips a performance check
- 3Only on the server side
Explanation
Bypass only for content you fully control, or sanitize it yourself first with a trusted library. Enable Trusted Types and a strict CSP for defense in depth.