1

In an angular2 application (rc1) I store some data in localstorage. I want to give the user the possibility to store the data in a file and import it on a different system or browser. It was hard to find out how to do this, because of sanitization. Finally I came to this solution.

import { DomSanitizationService } from '@angular/platform-browser';
import { UserdataService } from '../shared';
export class ExportComponent {
  constructor(private userdata: UserdataService, sanitizer:DomSanitizationService) {
   let dataString = JSON.stringify(userdata.getDataObject());
   let blob = new Blob([dataString], { type: 'application/json' });
   this.downloadurl =
       sanitizer.bypassSecurityTrustUrl(URL.createObjectURL(blob));
}

which I used in a template

<a [href]="downloadurl" download="data.json" >Download</a>

I found the sanitizer and its method bypassSecurityTrustUrl by guessing and grepping in @angular/platform-browser/src/security/dom_sanitization_service.d.ts. I could not find any documentation for it.

Is this the right way to tackle this problem? If I leave out the call to bypass the security trust, the URL gets prefixed by unsafe:, which makes it non-functional. Is there some documentation that I missed?

Pep
  • 11
  • 2

2 Answers2

1

Yes, the DomSanitizationService documentation is here:

https://angular.io/docs/ts/latest/api/platform-browser/index/DomSanitizer-class.html

Yoav Kadosh
  • 4,807
  • 4
  • 39
  • 56
null canvas
  • 10,201
  • 2
  • 15
  • 18
0

There is more complete documentation at http://g.co/ng/security now (though nothing specific to blobs - your code is good though!).

Martin Probst
  • 9,497
  • 6
  • 31
  • 33