Blog

Mert Özen's blog posts on software development, backend, frontend, and DevOps.

Series

.NET Core Web API 36 Angular 31 JavaScript Basics 19 JavaScript Intermediate 18 JavaScript Advanced 16 TypeScript Basics 14 TypeScript Intermediate 14 TypeScript Advanced 12 Entity Framework Core 28 Dapper 16 Git & GitHub 29 Web Security (OWASP Top 10) 21 LLM Fundamentals 20 C# Fundamentals 20 Object-Oriented Programming in C# 16 C# Collections and Generics 11 LINQ 17 Asynchronous Programming in C# 17 Advanced C# 14 C# Versions 6 Solution Patterns 22 SOLID and Design Principles 12 Clean Code 13 Design Patterns 23 UML and Modeling 18 Introduction to Software Architecture 9 Clean, Onion and Hexagonal Architecture 8 Vertical Slice Architecture 6 Domain-Driven Design 12 CQRS and Event Sourcing 10 Messaging and Event-Driven Architecture 9 Modular Monolith 2 Microservices 10 UI Architecture Patterns 9 Architecture Decisions 7 System Design 15 Distributed Systems Fundamentals 11 Background Jobs and Scheduled Jobs 11 Working with Message Queues 14 Logging in .NET 10 Caching 10 Real-time Applications 9 ASP.NET Core MVC and Razor Pages 13 CI/CD Fundamentals 8 GitHub Actions 16 Jenkins 12 Web Servers and Hosting 12 Deployment Strategies 9 Kubernetes 19 Authentication and Authorization 18

2 posts found #dompurify

Newest Oldest Popular

Security PART 04

Taking Trusted Types to Production: Angular Policies, Third-Party Libraries and Baseline 2026

Trusted Types makes DOM sinks accept only typed objects produced by an allowed policy instead of plain strings; even writing the result of DomSanitizer.sanitize to innerHTML is a violation. In this post we verify Angular's policy names in node_modules, build an inventory with Report-Only, resolve DOMPurify, loader and third-party script violations, show the danger of the default policy and summarize support, which became Baseline 2026 with Firefox 148.

8 Nov 2026 11 min 4

Security PART 02

A DOM XSS Sink Inventory for Angular: ElementRef, Renderer2, Dynamic URLs, HTML-Producing Libraries and a Code Review Checklist

Angular only sanitizes its own template bindings; ElementRef.nativeElement, Renderer2.setProperty/setAttribute, insertAdjacentHTML, dynamic script and iframe sources and HTML-producing libraries are unprotected. In this post we show these sinks in headless Chrome, fix them with the template and DomSanitizer, compare marked, DOMPurify and setHTML, and build a grep and ESLint based code review checklist.

8 Nov 2026 13 min 4