avoid bypassing xss protection

[danieljsinclair]

Request Type: docs

How to reproduce: If binding database data to a contentEditable that contains raw HTML the example in these docs binds it directly. Shouldn't it use the $sce service?

Component(s): misc core

Impact: small

Complexity: small

This issue is related to: security

Detailed Description:

element.html() sets the raw value directly in the dom which seems to bypass the built-in $sce protection one would normally get with a built-in directive. This seems dangerous to promote as an example. element.html() seems inherently dangerous to use in a directive. Could it alternatively be overridden to only accept safe strings? Perhaps with a safeHtml() alternative.

Other Comments:

element.html() sets the raw value directly in the dom which seems to bypass the built-in $sce protection one would normally get with a built-in directive. This seems dangerous to promote as an example. element.html() seems inherently dangerous to use in a directive. Could it alternatively be overridden to only accept safe strings? Perhaps with a safeHtml() alternative.

[mary-poppins]

Thanks for the PR! Please check the items below to help us merge this faster. See the contributing docs for more information.

• Uses the issue template (#7464)

If you need to make changes to your pull request, you can update the commit with git commit --amend.
Then, update the pull request with git push -f.

Thanks again for your help!

[mary-poppins]

I'm sorry, but I wasn't able to verify your Contributor License Agreement (CLA) signature. CLA signature is required for any code contributions to AngularJS.

Please sign our CLA and ensure that the CLA signature email address and the email address in this PR's commits match.

If you signed the CLA as a corporation, please let us know the company's name.

Thanks a bunch!

PS: If you signed the CLA in the past then most likely the email addresses don't match. Please sign the CLA again or update the email address in the commit of this PR.
PS2: If you are a Googler, please sign the CLA as well to simplify the CLA verification process.