anchor.diff:    your intended use of the value. Imagine the following template needs to bind a URL to a
     `javascript:alert(...)` call.
   
  +  记住，一个值是否安全依赖于它所在的环境，所以你要为这个值的预定用法选择正确的环境。假设下面的的模版需要绑定URL到`javascript.alert(...)`方法。
  +
   +makeExample('security/ts/app/bypass-security.component.html', 'dangerous-url')(format=".")
   :marked
     Normally, Angular would automatically sanitize the URL and disable the dangerous code. To prevent
     this, we can mark the URL value as a trusted URL using the `bypassSecurityTrustUrl` call:
  +
  +  一般情况下，Angular会自动无毒化这个URL并禁止危险的代码。为了防止这种行为，我们可以调用`bypassSecurityTrustUrl`，来标记这个URL值为一个信任的URL：
   
   +makeExample('security/ts/app/bypass-security.component.ts', 'trust-url')(format=".")
   figure.image-display
  
positive.code:   method on the controller to construct a new, trusted video URL, which is then bound to the
    `<iframe src>`.
  
  +makeExample('security/ts/app/bypass-security.component.html', 'iframe-videoid')(format=".")
  +makeExample('security/ts/app/bypass-security.component.ts', 'trust-video-url')(format=".")
  
  .l-main-section
  h2#http HTTP-level Vulnerabilities
  :marked
    Angular has built in support to help prevent two common HTTP vulnerabilities, Cross-site Request
    Forgery (XSRF) and Cross-site Script Inclusion (XSSI). Both of these must be primarily mitigated
    on the server side, but Angular ships helpers to make integration on the client side easier.
  
  h3#xsrf Cross-site Request Forgery (XSRF)
  :marked
    In a Cross-site Request Forgery (XSRF or CSRF), an attacker tricks the user into visiting a
    _different_ page, and has them e.g. submit a form that sends a request to your application's
    web server. If the user is logged into your application, the browser will send authentication
    cookies, and the attacker could - for example - cause a bank transfer in the user's name with
    the right request.
  
    To prevent this, your application must make sure that user requests originate in your own
    application, not on a different site. A common technique is that the server sends a randomly
  
negative.code:   generate Angular templates on the server side using a templating language, this carries a high
    risk of introducing template injection vulnerabilities.
  
    服务器端构造的HTML很容易被注入攻击。当在服务器端生成HTML，比如Angular应用程序的初始化页面加载时，
    确保在服务器端使用一个能够自动无害化值以防止XSS漏洞的模版语言。不要在服务器端使用一个模版语言生成Angular模版，
    这样会带来很高的引入模版注入漏洞的风险。
  
  .l-main-section
  h2#bypass-security-apis Trusting Safe Values
  
  h2#bypass-security-apis 信任安全的值
  :marked
    Sometimes applications genuinely need to include executable code, display an `<iframe>` from some
    URL, or construct potentially dangerous URLs. To prevent automatic sanitization in this situation,
  