safeInnerHtml property

@Input() set safeInnerHtml (dynamic safeInnerHtml)

Implementation

@Input()
set safeInnerHtml(dynamic safeInnerHtml) {
  // print('Setting inner html as $safeInnerHtml');
  if (safeInnerHtml is SafeHtml) {
    // `setHTMLUnsafe` parses without sanitizing, which is what this directive
    // is for and what the `NodeTreeSanitizer.trusted` argument meant when
    // this used `setInnerHtml`. Assigning `textContent` instead would insert
    // the markup as a text node, rendering the tags as visible characters.
    _element?.setHTMLUnsafe(
      safeInnerHtml.changingThisWillBypassSecurityTrust.toJS,
    );
  } else if (safeInnerHtml == null) {
    _element?.textContent = '';
  } else {
    // A regular string is not allowed since a security audit needs to be able
    // to search for SafeHtml and identify all locations where we are
    // bypassing sanitization. This also enforces SafeHtml usage at the
    // origin instead of passing a primitive string through layers
    // of code which could introduce mutations making security auditing
    // hard.
    throw UnsupportedError('SafeHtml required (got $safeInnerHtml)');
  }
}