tchatel/last-tweets-angularjs — pull request #1 by igorrosenberg (2013-11-15 13:22:04+00:00)
Title: ng-bind-html & html entities

I propose to decode html entities, as there is no need to protect against injection attacks, when using the ng-bind-html attribute (from the docs, "[ngBindHtml directive] By default, the innerHTML-ed content will be sanitized using the $sanitize service." see http://docs.angularjs.org/api/ng.directive:ngBindHtml)

I've tried to inject some code, with some hand injection in the tweet data, via
```
$scope.tweets[0].text = '';
$scope.tweets[1].text = ''.replace(//g, ">");
```
and I can never inject the javascript snippets (I suppose the ng-bind-html works as advertised and does sanitation)

Nonetheless, I don't know where the encoded entities come from - is the twitter data malformed, or is the service 'http://www.methotic.com/apps/twitter-demo/search?q=angularjs&count=50' inserting the html escaping ?