{"record":{"id":"c9a171e525e5a6a9","repo":"angular/components","slug":"the-url-provided-to-maticonregistry-was-not-truste","errorCode":null,"errorMessage":"The URL provided to MatIconRegistry was not trusted as a resource URL via Angular's DomSanitizer. Attempted URL was \"${safeUrl}\".","messagePattern":"The URL provided to MatIconRegistry was not trusted as a resource URL via Angular's DomSanitizer\\. Attempted URL was \"(.+?)\"\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/material/icon/icon-registry.ts","lineNumber":343,"sourceCode":"   * have a fontSet input value, and is not loading an icon by name or URL.\n   */\n  getDefaultFontSetClass(): string[] {\n    return this._defaultFontSetClass;\n  }\n\n  /**\n   * Returns an Observable that produces the icon (as an `<svg>` DOM element) from the given URL.\n   * The response from the URL may be cached so this will not always cause an HTTP request, but\n   * the produced element will always be a new copy of the originally fetched icon. (That is,\n   * it will not contain any modifications made to elements previously returned).\n   *\n   * @param safeUrl URL from which to fetch the SVG icon.\n   */\n  getSvgIconFromUrl(safeUrl: SafeResourceUrl): Observable<SVGElement> {\n    const url = this._sanitizer.sanitize(SecurityContext.RESOURCE_URL, safeUrl);\n\n    if (!url) {\n      throw getMatIconFailedToSanitizeUrlError(safeUrl);\n    }\n\n    const cachedIcon = this._cachedIconsByUrl.get(url);\n\n    if (cachedIcon) {\n      return observableOf(cloneSvg(cachedIcon));\n    }\n\n    return this._loadSvgIconFromConfig(new SvgIconConfig(safeUrl, null)).pipe(\n      tap(svg => this._cachedIconsByUrl.set(url!, svg)),\n      map(svg => cloneSvg(svg)),\n    );\n  }\n\n  /**\n   * Returns an Observable that produces the icon (as an `<svg>` DOM element) with the given name\n   * and namespace. The icon must have been previously registered with addIcon or addIconSet;\n   * if not, the Observable will throw an error.","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/angular/components/blob/0411926e7d8ae06b32236ec1048a888cfad5abf2/src/material/icon/icon-registry.ts#L325-L361","documentation":"getSvgIconFromUrl sanitizes the provided SafeResourceUrl through DomSanitizer's RESOURCE_URL context before fetching. If the URL wasn't trusted via bypassSecurityTrustResourceUrl (or sanitization yields empty), the registry throws this error rather than requesting an unsafe resource.","triggerScenarios":"Calling registry.getSvgIconFromUrl(this.someUrl) with a plain string cast as SafeResourceUrl, or a URL never passed through sanitizer.bypassSecurityTrustResourceUrl; also when a bound/interpolated URL string is handed to addSvgIconInNamespace paths that fetch by URL.","commonSituations":"Loading icons from a CDN or assets host without registering the domain; Angular strict template checking absent so string sneaks into SafeResourceUrl position; migration to Angular's stricter security defaults making previously 'working' raw-string URLs throw.","solutions":["Trust the URL once: sanitizer.bypassSecurityTrustResourceUrl(url) before passing it.","Better: register icons via addSvgIcon / addSvgIconSet with trusted URLs at bootstrap instead of ad-hoc getSvgIconFromUrl calls.","UseDomSanitizer injection: constructor(private sanitizer: DomSanitizer) and wrap where the URL is created, not where consumed.","Verify the value isn't empty/undefined — a falsy URL also fails sanitization and throws the same error."],"exampleFix":"// before\nthis.registry.getSvgIconFromUrl(iconUrl as any);\n// after\nconst safeUrl = this.sanitizer.bypassSecurityTrustResourceUrl(iconUrl);\nthis.registry.getSvgIconFromUrl(safeUrl);","handlingStrategy":"type-guard","validationCode":"import { SafeResourceUrl } from '@angular/platform-browser';\nfunction isTrustedResourceUrl(v: unknown): v is SafeResourceUrl {\n  return typeof v === 'object' && v !== null && 'changingThisBreaksApplicationSecurity' in v;\n}\nif (!isTrustedResourceUrl(url)) url = sanitizer.bypassSecurityTrustResourceUrl(String(url));","typeGuard":"function isSafeResourceUrl(v: unknown): v is SafeResourceUrl {\n  return !!v && typeof v === 'object' &&\n    typeof (v as any).changingThisBreaksApplicationSecurity === 'string';\n}","tryCatchPattern":"try {\n  await registry.getSvgIconFromUrl(safeUrl).toPromise();\n} catch (e) {\n  if (e instanceof Error && e.message.includes('not trusted as a resource URL')) {\n    console.error('Trust the URL with bypassSecurityTrustResourceUrl before use.');\n  } else { throw e; }\n}","preventionTips":["Wrap every icon URL with DomSanitizer.bypassSecurityTrustResourceUrl exactly once.","Create SafeResourceUrl values at the source, not at the consumption site.","Never cast plain strings to SafeResourceUrl with `as any`."],"tags":["angular-material","icon-registry","domsanitizer","security","safe-resource-url"],"backgroundTag":"untrusted-resource-url","analyzedSha":"0411926e7d8ae06b32236ec1048a888cfad5abf2","analyzedAt":"2026-08-31T11:58:23.400Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}