angular - Angular2 - Expected safevalue must use [property] = binding -

i writing test safepipe. method uses bypasssecuritytrustresourceurl() . searched available solutions , tried them unfortunately, didn't me. error is

expected safevalue must use [property]=binding: cross (see http://g.co/ng/security#xss) 'cross site request'.

what's wrong doing here?

import {pipe, pipetransform} "@angular/core"; import {domsanitizer} "@angular/platform-browser";  @pipe({name: 'safe'})  export class safepipe implements pipetransform {   constructor(private sanitizer: domsanitizer) {  }   public transform(url: string): {    return this.sanitizer.bypasssecuritytrustresourceurl(url);  } } 

test is:

import {safepipe} './safe.pipe'; import {domsanitizer} "@angular/platform-browser"; import {domsanitizerimpl} "@angular/platform-browse/src/security/dom_sanitization_service";  fdescribe('safepipe', () => {   let pipe: safepipe;   let sanitizer: domsanitizer = new domsanitizerimpl();   beforeeach(() => {     pipe = new safepipe(sanitizer);   });    it('should transform', () => {     expect(pipe.transform("cross <script>alert('hello')</script>")).tobe("cross alert('hello')");   }); }); 

sanitizer.bypasssecuritytrustresourceurl method returns saferesourceurlimpl class , can't convert string (jasmine trying convert internally).

abstract class safevalueimpl implements safevalue {   constructor(public changingthisbreaksapplicationsecurity: string) {     // empty   }    abstract gettypename(): string;    tostring() {     return `safevalue must use [property]=binding: ${this.changingthisbreaksapplicationsecurity}` +         ` (see http://g.co/ng/security#xss)`;   } } 

you should use domsanitizer.sanitize method instead (angular uses when applies property [url]="value | safe")

it('should transform', () => {   const saferesourceurl = pipe.transform("cross <script>alert('hello')</script>");   const sanitizedvalue = sanitizer.sanitize(securitycontext.resource_url, saferesourceurl);    expect(sanitizedvalue).tobe("cross <script>alert('hello')</script>"); }); 

ps. here assume have typo in tobe statement, , expecting string save script tags.

complete example can find in plunker