Angular Unsafe Property Binding

Description

Property bindings like [innerHTML] and [src] with untrusted data enable XSS attacks when Angular's sanitizer is bypassed or insufficient.

What Shoulder detects

Property binding '{binding}' used without explicit sanitization. This may allow XSS if bound to untrusted data.

How to fix

Use DOMPurify to sanitize content before binding to innerHTML.

```typescript
import DOMPurify from 'dompurify';

export class UserProfileComponent {
  get sanitizedBio(): string {
    return DOMPurify.sanitize(this.userBio, {
      ALLOWED_TAGS: ['p', 'br', 'strong', 'em'],
      ALLOWED_ATTR: []
    });
  }
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-79/unsafe-property-binding