javascript - Angular ng-bind-html - prevent execution of JS code -

i have problem ng-bind-html directive.

i email html data external services (not trusted), may happen receive <script> tag inside message body. don't want execute js code on page. using ng-bind-html directive this.

i created example , problem alert() function executed. how deny this?

var app = angular.module('myapp', ['ngsanitize']);    app.controller('mainctrl', function ($sce, $scope) {      $scope.text = " <script>alert(222)</script> <script>alert(222)</script>";  });

<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.2.23/angular.min.js"></script>  <div ng-app="myapp" ng-controller="mainctrl">      <div ng-bind-html="text"></div>  </div>

https://jsfiddle.net/suvroc/0c0ee472/8/

since have referenced old version of angularjs, prevented getting proper errors, difficult interpret. tried in similar fashion , found out errors, showed there problem text has been bind containing <script>.

actually, when 1 terminates script tag, -> </script>, compiler generates error, showing invalid.

this has happened me while working project, where, developers deliberately removed </script> prevent run-time errors. otherwise whole code breaks.

i don't know actual reason behind it, has done trick in past.

so in code demo, script doesn't runs itself; case, removing or preventing ending/closing of script tag, might trick.

meanwhile, can have code below:

html:

<div ng-app="app" ng-controller="test">   run time binding of html   <div ng-bind-html="text"></div> </div> 

js:

var app = angular.module('app', []);  app.controller('test', function($scope, $sce, $timeout) {   $scope.bindhtml = "<script>alert(123);";   $scope.text = $sce.trustashtml($scope.bindhtml); });