I'm writing an application which shows several different kind of devices in a single page and loads external templates depending on the device type.
Users will be able to submit custom templates, so I need to sanitize them.
Currently I'm using ng-repeat with a custom directive to show the devices, which makes use of:
template: '<ng-include src="getTemplateUrl()"></ng-include>'
scope.getTemplateUrl() is a function which I declared inside of the directive's link function which returns an URL depending on the device type.
It works flawlessly, but as I said I need to sanitize the URL content.
Unfortunately ng-bind-html wants an expression and not an URL, so the following will not work:
template: '<div ng-bind-html="getTemplateUrl()"/></div>'
I would like to avoid messing with async operations like $http inside my directive, so I cannot simply get the URL content and I don't know how could I use $sanitize directly without first retrieving the url content.