title: Angular 1.2: ng-bind-html removes src attribute on img
body: <p>I'm working on a CMS driven website using Angular (1.2 RC2) on the client side. As the content comes from a CMS I'm unfortunately forced to use receive HTML in JSON Strings. Most of the HTML gets injected and rendered just fine, but image tags have their src stripped away. From what I've read the src should have been prefixed with "unsafe:", not removed entirely if this was a XSS security issue in Angular .. but I might be mistaken.</p>
  
  <p>I've been at this problem for a while now and feel I've tried everything from plausible to downright stupid. Whitelisting my CMS url, whitelisting everything, disabling <strong>$sce</strong>, forcing html trough <strong>$sce.trustAsHtml()</strong> and well ... So far, no luck. As the site is CMS driven I'm unfortunatly not able to create a plunker / fiddle, but I'm hoping a kind soul will try to help out anyway.</p>
  
  <p><strong>Update</strong>: Forgot to mention that I've also tried <strong>ng-src</strong>, same effect. 
  <strong>Update II</strong>: If I use a HTTPS the src attribute remains and the image is shown. This is acceptable as it will run on HTTPS in production, but I still would like to know why disabling $sce doesn't work.</p>
  
  <p><strong>HTML as seen by the browser</strong> (content of slide.body)</p>
  
  <pre><code>&lt;div class="row"&gt;
      &lt;div class="col-md-6 visible-md visible-lg"&gt;
          &lt;img alt="none" class="img-responsive"&gt;
      &lt;/div&gt;
      &lt;div class="col-xs-12 col-md-6"&gt;
          &lt;div class="itx-article-header"&gt;
               &lt;h1&gt;Sulvat Quis 1&lt;/h1&gt;
  
               &lt;h2&gt;– Nullam dictum ac enim&lt;/h2&gt;
  
          &lt;/div&gt;
          &lt;p&gt;Proin quis justo vel felis varius sodales sit amet ut diam.&lt;/p&gt;
      &lt;/div&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p><strong>JADE (HTML)</strong></p>
  
  <pre><code>.my-carousel(ng-controller='CarouselCtrl')
      carousel(interval='myInterval')
          slide(ng-repeat='slide in slides', active='slide.active')
              .my-carousel-item(ng-bind-html='slide.body')
  </code></pre>
  
  <p><strong>Angular Controller</strong></p>
  
  <pre><code>.controller('CarouselCtrl', ['$sce', 'Article', '$scope',
      function($sce, Article, $scope) {
          $scope.myInterval = -1;
          $scope.slides = Article.query(
              {category: 'carousel'},
              function(data){
                  for (var i = 0; i &lt; data.length; i++) {
                      $scope.slides[i].body = $sce.trustAsHtml(data[i].body);                     
                  }
              },
              function() {
                  // Fail
              });
      }])
  </code></pre>
  
  <p><strong>Example JSON Response (Slide)</strong>
  <em>Sorry about the wide box, didn't manage to format it.</em></p>
  
  <pre><code>{
  "cmarId": 16,
  "corp": {
      "corpId": 2,
      "guiSelected": false
  },
  "createdAt": "Sep 27, 2013",
  "articleTag": "slide-1",
  "headline": "Slide 1",
  "highlighted": false,
    "body": "\u003cdiv class\u003d\"container my-carousel-container-small\"\u003e\r\n\u003cdiv class\u003d\"row\"\u003e\r\n\u003cdiv class\u003d\"col-md-6 visible-md visible-lg\"\u003e\u003cimg ng-src\u003d\"img/illustrative/laptop.jpg\" alt\u003d\"none\" class\u003d\"img-responsive\" /\u003e\u003c/div\u003e\r\n\u003cdiv class\u003d\"col-xs-12 col-md-6\"\u003e\r\n\u003cdiv class\u003d\"my-article-header\"\u003e\r\n\u003ch1\u003eSulvat Quis 1\u003c/h1\u003e\r\n\u003ch2\u003e– Nullam dictum ac enim\u003c/h2\u003e\r\n\u003c/div\u003e\r\n\u003cp\u003eProin quis justo vel felis varius sodales sit amet ut diam. Fusce auctor sapien nec purus sagittis, in venenatis turpis luctus. Nullam dictum ac enim sed commodo. Vivamus et placerat sapien.\u003c/p\u003e\r\n\u003c/div\u003e\r\n\u003c/div\u003e\r\n\u003c/div\u003e",
  "articlePriority": 0,
  "category": {
      "cmcaId": 9,
      "corp": {
          "corpId": 2,
          "guiSelected": false
      },
      "name": "carousel",
      "visibleInMenu": false
  },
  "published": true
  </code></pre>
  
  <p>}</p>