anchor.diff:    });
   }
   
  +// <script> tags are inert in innerHTML: https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML#Security_considerations
  +// placeholder from //gws/suite/img/img_test.js
  +const String DANGEROUS_HTML = '''
  +  <img src='data:image/gif;base64,R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=='
  +       onload="document.querySelector('.other-element').innerText = 'Unsafe'">
  +   </img>
  +''';
  +
   @Component(
     selector: 'test',
     template: r'''
  -       <span class="other-element">Secure</span>
  +       (<span class="other-element">Secure</span>)
          <div [innerHtml]="trustedHtml"></div>
       ''',
   )
   class NormalInnerHtmlTest {
  -  String get trustedHtml => r'''
  -    <script>
  -      document.querySelector('.other-element').innerText = 'Unsafe';
  -    </script>
  -  ''';
  +  String get trustedHtml => DANGEROUS_HTML;
   }
   
   @Component(
     selector: 'test',
     directives: [SafeInnerHtmlDirective],
     template: r'''
  -       <span class="other-element">Secure</span>
  +       (<span class="other-element">Secure</span>)
          <div [safeInnerHtml]="trustedHtml"></div>
       ''',
   )
  
positive.code:   final SafeHtml trustedHtml;
  
    TrustedInnerHtmlTest(DomSanitizationService domSecurityService)
        : trustedHtml = domSecurityService.bypassSecurityTrustHtml(r'''
          <script>
            document.querySelector('.other-element').innerText = 'Unsafe';
          </script>
        ''');
  }
  
  @Component(
  
negative.code:     test('normally, "innerHtml" should be sanitized', () async {
        var testBed = NgTestBed<NormalInnerHtmlTest>();
        var testRoot = await testBed.create();
        expect(testRoot.text, contains('(Secure)'));
      });
  
      test('"safeInnerHtml" should be trusted', () async {
        var testBed = NgTestBed<TrustedSafeInnerHtmlTest>();
        var testRoot = await testBed.create();
        expect(testRoot.text, contains('(Unsafe)'));
      });
  
      test('"innerHtml" should be trusted', () async {
        var testBed = NgTestBed<TrustedInnerHtmlTest>();
        var testRoot = await testBed.create();
        expect(testRoot.text, contains('(Unsafe)'));
      });
  
      test('normally, interpolated innerHtml should be sanitized', () async {
        var testBed = NgTestBed<InterpolatedNormalInnerHtmlTest>();
        var testRoot = await testBed.create();
        expect(testRoot.text, contains('(Secure)'));
      });
  
      test('SafeHtml should be passed through interpolation', () async {
        var testBed = NgTestBed<InterpolatedTrustedInnerHtmlTest>();
        var testRoot = await testBed.create();
        expect(testRoot.text, contains('(Unsafe)'));
      });
  
      test('unsafe HTML should throw', () async {
  