bugfix: iframe sandbox attr

bugfix: pureATPSelector edgecase

src/atlasComponents/sapiViews/core/rich/ATPSelector/pureDumb/pureATPSelector.template.html

 <ng-template [ngIf]="selectedATP" let-ATP>
 
   <!-- parcellation smart chip -->
-  <sxplr-smart-chip *ngIf="ATP.parcellation && parcAndGroup.length > 1"
-    [items]="parcAndGroup"
+  <sxplr-smart-chip *ngIf="ATP.parcellation && parcAndGroup && parcAndGroup.length > 1"
+    [items]="parcAndGroup || []"
     [color]="colorPalette[2]"
     [getChildren]="getChildren"
     (itemClicked)="selectLeaf({ parcellation: $event })"
@@ -44,8 +44,8 @@
   </sxplr-smart-chip>
 
   <!-- space smart chip -->
-  <sxplr-smart-chip *ngIf="ATP.template && availableTemplates.length > 1"
-    [items]="availableTemplates"
+  <sxplr-smart-chip *ngIf="ATP.template && availableTemplates && availableTemplates.length > 1"
+    [items]="availableTemplates || []"
     [color]="colorPalette[1]"
     (itemClicked)="selectLeaf({ template: $event })"
     [elevation]="4"

src/plugin/pluginPortal/pluginPortal.component.ts

@@ -7,10 +7,17 @@ import { getUuid } from "src/util/fn";
 import { WIDGET_PORTAL_TOKEN } from "src/widget/constants";
 import { getPluginSrc, SET_PLUGIN_NAME } from "../const";
 
+/**
+ * sandbox attribute must be set statically
+ * see https://angular.io/errors/NG0910
+ */
+
 @Component({
   selector: 'sxplr-plugin-portal',
   template: `
-  <iframe [src]="src | iframeSrc" [sandbox]="sandbox" #iframe>
+  <iframe [src]="src | iframeSrc"
+    sandbox="allow-downloads allow-popups allow-popups-to-escape-sandbox allow-scripts"
+    #iframe>
   </iframe>
   `,
   styles: [
@@ -21,13 +28,6 @@ import { getPluginSrc, SET_PLUGIN_NAME } from "../const";
 
 export class PluginPortal implements AfterViewInit, OnDestroy, ListenerChannel{
 
-  sandbox = [
-    "allow-downloads",
-    "allow-popups",
-    "allow-popups-to-escape-sandbox",
-    "allow-scripts",
-  ].join(" ")
-
   @ViewChild('iframe', { read: ElementRef })
   iframeElRef: ElementRef
   src: string