Angular is the underlying framework that powers Ionic.
Angular has a mechanism to prevent cross-site scripting attacks (XSS).
For example, when binding a URL in an <a [href]="someValue"> hyperlink, someValue will be sanitized so that an attacker cannot inject e.g. a javascript: URL that would execute code on the website.
Please refer to here.