From bb3d16516fdbb9fb11878932aef27b5a3d9ff05e Mon Sep 17 00:00:00 2001
From: Ruslan Lekhman <lekhman112@gmail.com>
Date: Tue, 14 Oct 2025 14:41:33 -0600
Subject: [PATCH] fix: sanitize back to application html text

---
 src/account/pages/account/account.component.html            | 6 +++++-
 src/account/pages/account/account.component.ts              | 3 ++-
 .../pages/logout-confirm/logout-confirm.component.html      | 6 +++++-
 src/login/pages/logout-confirm/logout-confirm.component.ts  | 3 ++-
 4 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/account/pages/account/account.component.html b/src/account/pages/account/account.component.html
index 7cd54334..a435ea8b 100644
--- a/src/account/pages/account/account.component.html
+++ b/src/account/pages/account/account.component.html
@@ -137,7 +137,11 @@ <h2>{{ i18n.msgStr('editAccountHtmlTitle') }}</h2>
         >
             <div>
                 @if (referrer) {
-                    <a [href]="referrer?.url">{{ i18n.msgStr('backToApplication') }}</a>
+                    <a
+                        [href]="referrer!.url"
+                        [innerHTML]="i18n.msgStr('backToApplication') | kcSanitize: 'html'"
+                    >
+                    </a>
                 }
                 <button
                     type="submit"
diff --git a/src/account/pages/account/account.component.ts b/src/account/pages/account/account.component.ts
index ceed18c7..f732e934 100644
--- a/src/account/pages/account/account.component.ts
+++ b/src/account/pages/account/account.component.ts
@@ -7,11 +7,12 @@ import type { KcContext } from '@keycloakify/angular/account/KcContext';
 import { ACCOUNT_CLASSES } from '@keycloakify/angular/account/tokens/classes';
 import { ACCOUNT_I18N } from '@keycloakify/angular/account/tokens/i18n';
 import { KC_ACCOUNT_CONTEXT } from '@keycloakify/angular/account/tokens/kc-context';
+import { KcSanitizePipe } from '@keycloakify/angular/lib/pipes/kc-sanitize';
 import { USE_DEFAULT_CSS } from '@keycloakify/angular/lib/tokens/use-default-css';
 import type { ClassKey } from 'keycloakify/account';
 
 @Component({
-    imports: [KcClassDirective, NgClass],
+    imports: [NgClass, KcClassDirective, KcSanitizePipe],
     selector: 'kc-account',
     templateUrl: 'account.component.html',
     providers: [
diff --git a/src/login/pages/logout-confirm/logout-confirm.component.html b/src/login/pages/logout-confirm/logout-confirm.component.html
index f4e1eb99..98e94efb 100644
--- a/src/login/pages/logout-confirm/logout-confirm.component.html
+++ b/src/login/pages/logout-confirm/logout-confirm.component.html
@@ -42,7 +42,11 @@
     <div id="kc-info-message">
         @if (!logoutConfirm.skipLink && client.baseUrl) {
             <p>
-                <a [href]="client.baseUrl">{{ i18n.msgStr('backToApplication') }}</a>
+                <a
+                    [href]="client.baseUrl"
+                    [innerHTML]="i18n.msgStr('backToApplication') | kcSanitize: 'html'"
+                >
+                </a>
             </p>
         }
     </div>
diff --git a/src/login/pages/logout-confirm/logout-confirm.component.ts b/src/login/pages/logout-confirm/logout-confirm.component.ts
index e85078f0..1dec9f94 100644
--- a/src/login/pages/logout-confirm/logout-confirm.component.ts
+++ b/src/login/pages/logout-confirm/logout-confirm.component.ts
@@ -1,4 +1,5 @@
 import { ChangeDetectionStrategy, Component, forwardRef, inject, type TemplateRef, viewChild } from '@angular/core';
+import { KcSanitizePipe } from '@keycloakify/angular/lib/pipes/kc-sanitize';
 import { ComponentReference } from '@keycloakify/angular/login/classes/component-reference';
 import { KcClassDirective } from '@keycloakify/angular/login/directives/kc-class';
 import type { I18n } from '@keycloakify/angular/login/i18n';
@@ -7,7 +8,7 @@ import { LOGIN_I18N } from '@keycloakify/angular/login/tokens/i18n';
 import { KC_LOGIN_CONTEXT } from '@keycloakify/angular/login/tokens/kc-context';
 
 @Component({
-    imports: [KcClassDirective],
+    imports: [KcSanitizePipe, KcClassDirective],
     selector: 'kc-logout-confirm',
     templateUrl: 'logout-confirm.component.html',
     changeDetection: ChangeDetectionStrategy.OnPush,