Angular 2+ Sanitize Form Input for XSS attacks

Question

I am developing a web application using Angular2 Beta.

My forms include simple Text fields and Text areas which accept input from the user and the data is displayed back in the application.

These fields are not meant to take any HTML input and render them back in HTML format.

I tried entering simple javascript code like

<script>alert("XSS");</script>

It is displayed as it is without running the malicious code. :)

I would like to check if my application is vulnerable to XSS attacks.

Does Angular 2+ sanitize the user inputs by default?

Answer 1

Yes it does! Angular2 provides a built-in, enabled by default, anti XSS protection named DomSanitizationService.