avoid bypassing xss protection

Request Type: docs

How to reproduce: If binding database data to a contentEditable that contains raw HTML the example in these docs binds it directly. Shouldn't it use the $sce service?

Component(s): misc core

Impact: small

Complexity: small

This issue is related to: security

**Detailed Description:**

element.html() sets the raw value directly in the dom which seems to bypass the built-in $sce protection one would normally get with a built-in directive. This seems dangerous to promote as an example. element.html() seems inherently dangerous to use in a directive. Could it alternatively be overridden to only accept safe strings? Perhaps with a safeHtml() alternative.

**Other Comments:**

element.html() sets the raw value directly in the dom which seems to bypass the built-in $sce protection one would normally get with a built-in directive. This seems dangerous to promote as an example. element.html() seems inherently dangerous to use in a directive. Could it alternatively be overridden to only accept safe strings? Perhaps with a safeHtml() alternative.