Disable $ sce service flaws

Question

What bad can happen if I completely disable the $ sce service?

angular.module('app').config(function ($sceProvider) { $sceProvider.enabled(false); }); 

Answer 1

You should disable SCE if you are 100% sure that all application bindings (HTML, URL ...) are safe. For example, if an application always sanitizes user logins either on the server or in front of the client, then the additional ceremony applied by SCE may be required.

However, very rarely you can be 100% sure that all values ​​are safe, especially when the application is growing and encoded by many developers. Enabling SCE provides that the application can only use values ​​that are explicitly marked as reliable using one of the $sce.trustAsXXX methods.

For example, if you use ngBindHtml to render some HTML, AngularJS throws an error unless the scope variable assigned by ngBindHtml is wrapped in $sce.trustAsHtml . A similar application occurs when you set the templateUrl route or directive. This makes the application more secure with the error, which gives you the opportunity to check every place where the error occurs and decide whether to trust or fix it.

Finally, if you enable ngSanitize or implement the $sanitize service, then you do not need to disable SCE to use untrusted HTML values, since AngularJS will simply sanitize untrusted entries using the $sanitize service. Similarly, if the URL of the template shares the beginning as an application, there is no need to explicitly wrap it.

Answer 2

Can I completely disable SCE?

Yes, you can. However, this is highly discouraged. SCE gives you many security benefits for a small coding overhead. It is much harder to accept an application with SCE disabled and either protect it yourself or enable SCE at a later stage. It might make sense to disable SCE for cases where you have a lot of existing code that was written before SCE was introduced, and you are porting their module at the same time.

(from the documentation )