html content sanitized via safe-html pipe

npm/ng-packs/packages/core/src/lib/core.module.ts

@@ -33,6 +33,7 @@ import { getInitialData, localeInitializer } from './utils/initial-utils';
 import { ShortDateTimePipe } from './pipes/short-date-time.pipe';
 import { ShortTimePipe } from './pipes/short-time.pipe';
 import { ShortDatePipe } from './pipes/short-date.pipe';
+import { SafeHtmlPipe } from './pipes/safe-html.pipe';
 import { QUEUE_MANAGER } from './tokens/queue.token';
 import { DefaultQueueManager } from './utils/queue';
 import { IncludeLocalizationResourcesProvider } from './providers/include-localization-resources.provider';
@@ -63,6 +64,7 @@ import { IncludeLocalizationResourcesProvider } from './providers/include-locali
     ReplaceableTemplateDirective,
     RouterOutletComponent,
     SortPipe,
+    SafeHtmlPipe,
     StopPropagationDirective,
     ToInjectorPipe,
     ShortDateTimePipe,
@@ -90,6 +92,7 @@ import { IncludeLocalizationResourcesProvider } from './providers/include-locali
     ReplaceableTemplateDirective,
     RouterOutletComponent,
     SortPipe,
+    SafeHtmlPipe,
     StopPropagationDirective,
     ToInjectorPipe,
     ShortDateTimePipe,

npm/ng-packs/packages/core/src/lib/pipes/index.ts

@@ -1,4 +1,5 @@
 export * from './localization.pipe';
+export * from './safe-html.pipe';
 export * from './sort.pipe';
 export * from './to-injector.pipe';
 export * from './short-date.pipe';

npm/ng-packs/packages/core/src/lib/pipes/safe-html.pipe.ts

@@ -0,0 +1,13 @@
+import { inject, Injectable, Pipe, PipeTransform, SecurityContext } from '@angular/core';
+import { DomSanitizer } from '@angular/platform-browser';
+
+@Injectable()
+@Pipe({ name: 'abpSafeHtml' })
+export class SafeHtmlPipe implements PipeTransform {
+  private readonly sanitizer = inject(DomSanitizer);
+
+  transform(value: string): string {
+    if (typeof value !== 'string') return '';
+    return this.sanitizer.sanitize(SecurityContext.HTML, value);
+  }
+}

npm/ng-packs/packages/theme-basic/src/lib/components/page-alert-container/page-alert-container.component.html

@@ -7,9 +7,11 @@
     <h4
       class="alert-heading"
       *ngIf="alert.title"
-      [innerHTML]="alert.title | abpLocalization: alert.titleLocalizationParams"
+      [innerHTML]="alert.title | abpSafeHtml | abpLocalization: alert.titleLocalizationParams"
     ></h4>
-    <span [innerHTML]="alert.message | abpLocalization: alert.messageLocalizationParams"></span>
+    <span
+      [innerHTML]="alert.message | abpSafeHtml | abpLocalization: alert.messageLocalizationParams"
+    ></span>
     <button
       *ngIf="alert.dismissible"
       type="button"