From 96c35271a6ea65000a4f4ef3e4d0fb246f8a8083 Mon Sep 17 00:00:00 2001
From: masumulu28 <masum.ulu@hotmail.com>
Date: Wed, 22 Mar 2023 11:55:39 +0300
Subject: [PATCH 1/2] page-alert-container component updated for HTML content

---
 .../page-alert-container.component.html                | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/npm/ng-packs/packages/theme-basic/src/lib/components/page-alert-container/page-alert-container.component.html b/npm/ng-packs/packages/theme-basic/src/lib/components/page-alert-container/page-alert-container.component.html
index 53041e91dc..0cc1e2bf28 100644
--- a/npm/ng-packs/packages/theme-basic/src/lib/components/page-alert-container/page-alert-container.component.html
+++ b/npm/ng-packs/packages/theme-basic/src/lib/components/page-alert-container/page-alert-container.component.html
@@ -4,10 +4,12 @@
     [ngClass]="{ 'alert-dismissible fade show': alert.dismissible }"
     role="alert"
   >
-    <h4 class="alert-heading" *ngIf="alert.title">
-      {{ alert.title | abpLocalization: alert.titleLocalizationParams }}
-    </h4>
-    {{ alert.message | abpLocalization: alert.messageLocalizationParams }}
+    <h4
+      class="alert-heading"
+      *ngIf="alert.title"
+      [innerHTML]="alert.title | abpLocalization: alert.titleLocalizationParams"
+    ></h4>
+    <span [innerHTML]="alert.message | abpLocalization: alert.messageLocalizationParams"></span>
     <button
       *ngIf="alert.dismissible"
       type="button"

From 9bdd439c37ea089b1d822e9df9be9012ca15a200 Mon Sep 17 00:00:00 2001
From: masumulu28 <masum.ulu@hotmail.com>
Date: Thu, 23 Mar 2023 10:19:51 +0300
Subject: [PATCH 2/2] html content sanitized via safe-html pipe

---
 npm/ng-packs/packages/core/src/lib/core.module.ts   |  3 +++
 npm/ng-packs/packages/core/src/lib/pipes/index.ts   |  1 +
 .../packages/core/src/lib/pipes/safe-html.pipe.ts   | 13 +++++++++++++
 .../page-alert-container.component.html             |  6 ++++--
 4 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 npm/ng-packs/packages/core/src/lib/pipes/safe-html.pipe.ts

diff --git a/npm/ng-packs/packages/core/src/lib/core.module.ts b/npm/ng-packs/packages/core/src/lib/core.module.ts
index e3cd895022..9655be6c5f 100644
--- a/npm/ng-packs/packages/core/src/lib/core.module.ts
+++ b/npm/ng-packs/packages/core/src/lib/core.module.ts
@@ -33,6 +33,7 @@ import { getInitialData, localeInitializer } from './utils/initial-utils';
 import { ShortDateTimePipe } from './pipes/short-date-time.pipe';
 import { ShortTimePipe } from './pipes/short-time.pipe';
 import { ShortDatePipe } from './pipes/short-date.pipe';
+import { SafeHtmlPipe } from './pipes/safe-html.pipe';
 import { QUEUE_MANAGER } from './tokens/queue.token';
 import { DefaultQueueManager } from './utils/queue';
 import { IncludeLocalizationResourcesProvider } from './providers/include-localization-resources.provider';
@@ -63,6 +64,7 @@ import { IncludeLocalizationResourcesProvider } from './providers/include-locali
     ReplaceableTemplateDirective,
     RouterOutletComponent,
     SortPipe,
+    SafeHtmlPipe,
     StopPropagationDirective,
     ToInjectorPipe,
     ShortDateTimePipe,
@@ -90,6 +92,7 @@ import { IncludeLocalizationResourcesProvider } from './providers/include-locali
     ReplaceableTemplateDirective,
     RouterOutletComponent,
     SortPipe,
+    SafeHtmlPipe,
     StopPropagationDirective,
     ToInjectorPipe,
     ShortDateTimePipe,
diff --git a/npm/ng-packs/packages/core/src/lib/pipes/index.ts b/npm/ng-packs/packages/core/src/lib/pipes/index.ts
index 71ce383cd3..1a981ca041 100644
--- a/npm/ng-packs/packages/core/src/lib/pipes/index.ts
+++ b/npm/ng-packs/packages/core/src/lib/pipes/index.ts
@@ -1,4 +1,5 @@
 export * from './localization.pipe';
+export * from './safe-html.pipe';
 export * from './sort.pipe';
 export * from './to-injector.pipe';
 export * from './short-date.pipe';
diff --git a/npm/ng-packs/packages/core/src/lib/pipes/safe-html.pipe.ts b/npm/ng-packs/packages/core/src/lib/pipes/safe-html.pipe.ts
new file mode 100644
index 0000000000..c8445e8390
--- /dev/null
+++ b/npm/ng-packs/packages/core/src/lib/pipes/safe-html.pipe.ts
@@ -0,0 +1,13 @@
+import { inject, Injectable, Pipe, PipeTransform, SecurityContext } from '@angular/core';
+import { DomSanitizer } from '@angular/platform-browser';
+
+@Injectable()
+@Pipe({ name: 'abpSafeHtml' })
+export class SafeHtmlPipe implements PipeTransform {
+  private readonly sanitizer = inject(DomSanitizer);
+
+  transform(value: string): string {
+    if (typeof value !== 'string') return '';
+    return this.sanitizer.sanitize(SecurityContext.HTML, value);
+  }
+}
diff --git a/npm/ng-packs/packages/theme-basic/src/lib/components/page-alert-container/page-alert-container.component.html b/npm/ng-packs/packages/theme-basic/src/lib/components/page-alert-container/page-alert-container.component.html
index 0cc1e2bf28..914e803f95 100644
--- a/npm/ng-packs/packages/theme-basic/src/lib/components/page-alert-container/page-alert-container.component.html
+++ b/npm/ng-packs/packages/theme-basic/src/lib/components/page-alert-container/page-alert-container.component.html
@@ -7,9 +7,11 @@
     <h4
       class="alert-heading"
       *ngIf="alert.title"
-      [innerHTML]="alert.title | abpLocalization: alert.titleLocalizationParams"
+      [innerHTML]="alert.title | abpSafeHtml | abpLocalization: alert.titleLocalizationParams"
     ></h4>
-    <span [innerHTML]="alert.message | abpLocalization: alert.messageLocalizationParams"></span>
+    <span
+      [innerHTML]="alert.message | abpSafeHtml | abpLocalization: alert.messageLocalizationParams"
+    ></span>
     <button
       *ngIf="alert.dismissible"
       type="button"