anchor.diff:  
     ### Server side XSS protection
   
  -  HTML constructed on the server is vulnerable to injection attacks. When generating server side
  -  HTML, e.g. for the initial page load of the Angular application, make sure to use a templating
  -  language that automatically escapes values to prevent XSS vulnerabilities on the server. Do not
  -  generate Angular templates on the server side using a templating language, this carries a high
  -  risk of introducing template injection vulnerabilities.
  +  HTML constructed on the server is vulnerable to injection attacks. Injecting template code into an
  +  Angular application is the same as injecting executable code (e.g. JavaScript) into the
  +  application; it gives the attacker full control over the application. To prevent this, make sure
  +  to use a templating language that automatically escapes values to prevent XSS vulnerabilities on
  +  the server. Do not generate Angular templates on the server side using a templating language, this
  +  carries a high risk of introducing template injection vulnerabilities.
   
   .l-main-section
   h2#bypass-security-apis Trusting Safe Values
  
positive.code: block includes
    include ../_util-fns
  :marked
    Web application security has many aspects. This documentation describes Angular's built in
    protections against common web application vulnerabilities and attacks, such as Cross Site
    Scripting Attacks. It does not cover application level security, such as authentication (_Who is
  
negative.code: :marked
    If we need to convert user input into a trusted value, it can be convenient to do so in a
    controller method. The template below allows users to enter a YouTube video ID, and load the
    corresponding video in an `<iframe>`. The `<iframe src>` attribute is a resource URL security
    context, because an untrusted source can e.g. smuggle in file downloads that unsuspecting users
    would execute. So we call a method on the controller to construct a trusted video URL, which
    Angular then allows binding into `<iframe src>`.
  
  +makeExample('security/ts/app/bypass-security.component.html', 'iframe-videoid')(format=".")
  +makeExample('security/ts/app/bypass-security.component.ts', 'trust-video-url')(format=".")
  