2

I have an AngularJS application which I am loading as a plug in into another page with a different path. Therefore, my template URLs must be fully qualified in order for them to resolve to the correct file. However, I am receiving Error: $sce:insecurl Processing of a Resource from Untrusted Source Blocked.

I tried using resourceUrlWhitelist, but this didn't make my error go away, so I thought I would try trustAsResourceUrl. However, I don't know how to combine that with my component's definition.

Here is my component:

angular
  .module('synthApp')
  .component('foo', {
    templateUrl: 'http://example.com/app/components/main.template.html',
    controller: MainController
  });

function MainController() {
  ...
}

I tried the following but received an error that $sce is unknown:

angular
  .module('synthApp')
  .component('foo', ['$sce', {
    templateUrl: $sce.trustAsResourceUrl('http://example.com/app/components/main.template.html'),
    controller: MainController
  }]);

function MainController() {
  ...
}

What is the proper way to use trustAsResourceUrl in this situation? Thanks.

Sangwin Gawande
  • 7,658
  • 8
  • 48
  • 66
carmenism
  • 1,087
  • 3
  • 12
  • 31
  • Possible duplicate of [angular2 include external html template](https://stackoverflow.com/questions/42235621/angular2-include-external-html-template) – JSON Derulo Aug 22 '17 at 20:45

1 Answers1

4

component accepts a plain object. It cannot be used for DI like directive. .component('foo', ['$sce', { ... }]) isn't a correct syntax for any kind of DI (not just Angular) because it doesn't involve a function where a dependency could be injected.

As explained in this answer, templateUrl can be DI-enabled function.

It should be:

angular
  .module('synthApp')
  .component('foo', {
    templateUrl: ['$sce', function ($sce) {
      return $sce.trustAsResourceUrl('http://example.com/app/components/main.template.html');
    }],
    controller: MainController
  });
Estus Flask
  • 206,104
  • 70
  • 425
  • 565
  • I knew it was bad syntax but I didn't know how to get that `$sce` into the picture. This worked perfectly. Thanks! – carmenism Aug 22 '17 at 21:15