@@ -353,18 +353,18 @@ export class AngularEditorComponent implements OnInit, ControlValueAccessor, Aft
353353 oCode . focus ( ) ;
354354 } else {
355355 if ( this . doc . querySelectorAll ) {
356- // if sanitize: true the html element, from preview to text, is sanitized according the sanitizer config.
357- if ( this . config . sanitize !== false ) {
358- editableElement . innerText = this . sanitizer . sanitize ( SecurityContext . HTML , editableElement . innerText )
356+ // Apply sanitization to prevent XSS when switching from HTML mode
357+ if ( this . config . sanitize !== false ) {
358+ editableElement . innerText = this . sanitizer . sanitize ( SecurityContext . HTML , editableElement . innerText ) ;
359359 }
360360 this . r . setProperty ( editableElement , 'innerHTML' , editableElement . innerText ) ;
361361 } else {
362362 oContent = this . doc . createRange ( ) ;
363363 oContent . selectNodeContents ( editableElement . firstChild ) ;
364- let oContentString = oContent . toString ( )
365- // if sanitize: true the oContent is sanitized according the sanitizer config.
366- if ( this . config . sanitize !== false ) {
367- oContentString = this . sanitizer . sanitize ( SecurityContext . HTML , oContentString )
364+ let oContentString = oContent . toString ( ) ;
365+ // Apply sanitization to prevent XSS when switching from HTML mode
366+ if ( this . config . sanitize !== false ) {
367+ oContentString = this . sanitizer . sanitize ( SecurityContext . HTML , oContentString ) ;
368368 }
369369 this . r . setProperty ( editableElement , 'innerHTML' , oContentString ) ;
370370 }
0 commit comments