Add sanitize HTML

lib/src/markdown.service.spec.ts

@@ -1,5 +1,7 @@
 import { HttpClientTestingModule, HttpTestingController } from '@angular/common/http/testing';
+import { SecurityContext } from '@angular/core';
 import { TestBed } from '@angular/core/testing';
+import { BrowserModule, DomSanitizer } from '@angular/platform-browser';
 import { parse } from 'marked';
 
 import { MarkdownService } from './markdown.service';
@@ -9,12 +11,16 @@ import { MarkedOptions } from './marked-options';
 declare var Prism: any;
 
 describe('MarkdowService', () => {
+  let domSanitizer: DomSanitizer;
   let http: HttpTestingController;
   let markdownService: MarkdownService;
 
   beforeEach(() => {
     TestBed.configureTestingModule({
-      imports: [HttpClientTestingModule],
+      imports: [
+        BrowserModule,
+        HttpClientTestingModule,
+      ],
       providers: [
         { provide: MarkedOptions, useValue: {} },
         MarkdownService,
@@ -23,6 +29,7 @@ describe('MarkdowService', () => {
   });
 
   beforeEach(() => {
+    domSanitizer = TestBed.get(DomSanitizer);
     http = TestBed.get(HttpTestingController);
     markdownService = TestBed.get(MarkdownService);
   });
@@ -40,8 +47,9 @@ describe('MarkdowService', () => {
     it('should return parsed markdown correctly', () => {
 
       const mockRaw = '### Markdown-x';
+      const expected = domSanitizer.sanitize(SecurityContext.HTML, parse(mockRaw));
 
-      expect(markdownService.compile(mockRaw)).toBe(parse(mockRaw));
+      expect(markdownService.compile(mockRaw)).toBe(expected);
     });
 
     it('should return empty string when raw is null/undefined/empty', () => {
@@ -59,13 +67,13 @@ describe('MarkdowService', () => {
         '    * sub-list', // keep indent while removing from previous row offset
       ].join('\n');
 
-      const expected = [
+      const expected = domSanitizer.sanitize(SecurityContext.HTML, parse([
         '',
         '* list',
         '  * sub-list',
-      ].join('\n');
+      ].join('\n')));
 
-      expect(markdownService.compile(mockRaw)).toBe(parse(expected));
+      expect(markdownService.compile(mockRaw)).toBe(expected);
     });
 
     it('should return line with indent correctly', () => {
@@ -77,14 +85,14 @@ describe('MarkdowService', () => {
         'Lorem Ipsum',  // keep everthing else
       ].join('\n');
 
-      const expected = [
+      const expected = domSanitizer.sanitize(SecurityContext.HTML, parse([
         '* list',
         '  * sub-list',
         '',
         'Lorem Ipsum',
-      ].join('\n');
+      ].join('\n')));
 
-      expect(markdownService.compile(mockRaw)).toBe(parse(expected));
+      expect(markdownService.compile(mockRaw)).toBe(expected);
     });
   });
 

lib/src/markdown.service.ts

@@ -1,5 +1,6 @@
 import { HttpClient } from '@angular/common/http';
-import { Injectable, Optional } from '@angular/core';
+import { Injectable, Optional, SecurityContext } from '@angular/core';
+import { DomSanitizer } from '@angular/platform-browser';
 import { parse, Renderer } from 'marked';
 import { Observable } from 'rxjs';
 import { map } from 'rxjs/operators';
@@ -24,6 +25,7 @@ export class MarkdownService {
 
   constructor(
     @Optional() private http: HttpClient,
+    private domSanitizer: DomSanitizer,
     public options: MarkedOptions,
   ) {
     if (!this.renderer) {
@@ -33,7 +35,8 @@ export class MarkdownService {
 
   compile(markdown: string, markedOptions = this.options): string {
     const precompiled = this.precompile(markdown);
-    return parse(precompiled, markedOptions);
+    const compiled = parse(precompiled, markedOptions);
+    return this.domSanitizer.sanitize(SecurityContext.HTML, compiled);
   }
 
   getSource(src: string): Observable<string> {

package.json

@@ -29,6 +29,7 @@
     "build:lib": "ng build lib",
     "postbuild:lib": "cpx ./README.md ./dist/lib",
     "link:lib": "rimraf node_modules/ngx-markdown && linklocal",
+    "lint": "yarn lint:lib && yarn lint:demo",
     "lint:demo": "ng lint demo",
     "lint:lib": "ng lint lib",
     "lint:ci": "ng lint lib --format checkstyle > tslint.xml",