{"action":"closed","issue":{"url":"https://api.github.com/repos/Foxandxss/angular-toastr/issues/3","labels_url":"https://api.github.com/repos/Foxandxss/angular-toastr/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/Foxandxss/angular-toastr/issues/3/comments","events_url":"https://api.github.com/repos/Foxandxss/angular-toastr/issues/3/events","html_url":"https://github.com/Foxandxss/angular-toastr/issues/3","id":28542702,"number":3,"title":"Discussion about allowing HTML","user":{"login":"Foxandxss","id":1087957,"avatar_url":"https://avatars.githubusercontent.com/u/1087957?v=3","gravatar_id":"","url":"https://api.github.com/users/Foxandxss","html_url":"https://github.com/Foxandxss","followers_url":"https://api.github.com/users/Foxandxss/followers","following_url":"https://api.github.com/users/Foxandxss/following{/other_user}","gists_url":"https://api.github.com/users/Foxandxss/gists{/gist_id}","starred_url":"https://api.github.com/users/Foxandxss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Foxandxss/subscriptions","organizations_url":"https://api.github.com/users/Foxandxss/orgs","repos_url":"https://api.github.com/users/Foxandxss/repos","events_url":"https://api.github.com/users/Foxandxss/events{/privacy}","received_events_url":"https://api.github.com/users/Foxandxss/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2014-02-28T23:48:53Z","updated_at":"2015-04-06T17:50:23Z","closed_at":"2015-04-06T17:50:23Z","body":"I want to discuss here of what should we do about trusting html.\r\n\r\nI saw various ways, and I am not sure of any of them:\r\n\r\nAs today, you can add html onto it, `$sce` will trust your html but I am unsure how it works vs `XSS`. Using `ngSanitize` is also an option, but it doesn't allow to use form items on the toast.\r\n\r\nThe problem with `$sce` is that you can't put directives into the trusted HTML (that is intended). That doesn't mean I can create a directive where you can put any kind of html on your toast (even forms that will work with your scope), but that is highly insecure.\r\n\r\nI want to discuss what are your thoughts about this."}}