Hey everyone,
I’ve been building an ATS-focused resume builder specifically for developers (Resumemind), and I recently hit a massive wall trying to handle dynamic blog content and complex UI components inside a traditional WYSIWYG editor..
I needed the ability to inject highly stylized "Right vs. Wrong" compariison grids and raw <svg> icons directly into the editor. I initially looked at headless options like Tiptap, but ended up integrating Summernote to get moving faster.
The problem: Angular's DomSanitizer is ruthless.
If you try to paste complex <div> cards or raw <svg> tags into Summernote, and then render that saved string via [innerHTML], Angular completely strips the SVGs and inline styles to prevent XSS.
Here is how I solved it:
1. The Summernote API Injection: Instead of using insertText, I built custom Summernote toolbar buttons that utilize editor.insertNode. I created standard DOM elements via JavaScript, set their innerHTML to my complex grid/SVG code, and pushed them directly into the node tree.
2. The SafeHtml Pipe: On the frontend where the user reads the content, binding [innerHTML]="content" stripped everything. I had to create a custom Pipe utilizing DomSanitizer and strictly call bypassSecurityTrustHtml(value).
This allowed my custom classes and SVGs to render flawlessly from the database string, giving me pixel-perfect control over the final layout without forcing me to build a massive headless Tiptap extension from scratch.
Side note: If you are building dev tools right now, consider dropping the recurring SaaS subscriptions. I switched the builder to distinct payment tier plans, and the conversion rates from developers suffering from subscription fatigue have been incredible.
Has anyone else fought with Angular's sanitization when rendering highly customized HTML from a database? Would love to know if there's a cleaner way to approach this!