Angular Code Review Rules

Template Safety: Never interpolate untrusted user input into templates ({{ }}) without escaping or sanitizing using Angular's built-in mechanisms (DomSanitizer APIs). Always validate and escape any dynamic input before rendering
[innerHTML] Binding: If using [innerHTML], always sanitize input with DomSanitizer and add a code comment explaining why. Never bind raw user input directly

DomSanitizer Usage: Use DomSanitizer only after rigorous validation. Example safe usage:

// Safe: Sanitized HTML from trusted CMS after validation
this.sanitizedContent = this.sanitizer.sanitize(SecurityContext.HTML, trustedCmsContent);

Avoid bypassSecurityTrust* methods unless absolutely necessary; when used, require code comments justifying the bypass and document the validation applied
Validate route parameters and query strings to prevent injection attacks
Use Angular's built-in CSRF protection with HttpClient
Validate and sanitize data before binding it in templates, especially when displaying user-generated content in *ngFor loops or other directives
Never use HTML comments () to store sensitive data or instructions in templates

angular