From add023cf1fbf51ef0025427178dd78bceb442d9b Mon Sep 17 00:00:00 2001
From: shubhamsharma9199 <shubham.24bcs10320@sst.scaler.com>
Date: Thu, 6 Nov 2025 19:51:36 +0530
Subject: [PATCH] fix(find-pipe): sanitize HTML output to prevent XSS
 vulnerability

fix return type
---
 src/app/pipes/find.pipe.ts | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/app/pipes/find.pipe.ts b/src/app/pipes/find.pipe.ts
index df034ba28..669a050be 100644
--- a/src/app/pipes/find.pipe.ts
+++ b/src/app/pipes/find.pipe.ts
@@ -1,4 +1,5 @@
-import { Pipe, PipeTransform } from '@angular/core';
+import { Pipe, PipeTransform, SecurityContext } from '@angular/core';
+import { DomSanitizer } from '@angular/platform-browser';
 
 /**
  * Cache for storing lookup maps per options array reference.
@@ -9,7 +10,9 @@ const lookupCache = new WeakMap<any[], Map<string, Map<any, any>>>();
 
 @Pipe({ name: 'find' })
 export class FindPipe implements PipeTransform {
-  transform(value: any, options: any, key: string, property: string): any {
+  constructor(private sanitizer: DomSanitizer) {}
+
+  transform(value: any, options: any, key: string, property: string): string {
     if (!options || !key || value === null || value === undefined) {
       return '';
     }
@@ -38,6 +41,13 @@ export class FindPipe implements PipeTransform {
 
     // O(1) lookup
     const optionFound = valueMap.get(value);
-    return optionFound ? (optionFound[property] ?? '') : '';
+    const result = optionFound ? (optionFound[property] ?? '') : '';
+
+    // Sanitize string results to prevent XSS
+    if (typeof result === 'string') {
+      return this.sanitizer.sanitize(SecurityContext.HTML, result) || '';
+    }
+
+    return String(result || '');
   }
 }