title: Angular, DomSanitizer, bypassSecurity script
body: <p>I'm playing with <code>bypassSecurityTrust*</code> functions of Angular. Goal is to get a <code>script</code> tag to execute on the page. But it either keeps sanitizing with the message </p>
  
  <p><code>WARNING: sanitizing HTML stripped some content</code></p>
  
  <p>or I see in the console a</p>
  
  <p><code>SafeHtmlImpl {changingThisBreaksApplicationSecurity: "&lt;script&gt;alert(1)&lt;/script&gt;</code>.</p>
  
  <p>Goal is to get this working.</p>
  
  <p>What I currently use and tried:</p>
  
  <pre><code>@Pipe({ name: 'safeHtml'})
  export class SafeHtmlPipe implements PipeTransform  {
    constructor(private sanitized: DomSanitizer) {}
    transform(value: string): string {
      console.log(this.sanitized.sanitize(SecurityContext.NONE, value))
      return this.sanitized.sanitize(SecurityContext.NONE, value);
    }
  }
  @Component({
    selector: 'app-demo',
    templateUrl: './demo.component.html',
    styleUrls: ['./demo.component.css']
  })
  export class DemoComponent implements OnInit {
  
    name: string;
    html: string;
    constructor(private sanitizer: DomSanitizer) {
      this.name = 'Angular2';
      this.html = "&lt;script&gt; alert(8) &lt;/script&gt;";
    }
    ngOnInit() {
    }
  }
  </code></pre>
  
  <p>and the template html:</p>
  
  <pre><code>&lt;div [innerHtml]="html | safeHtml"&gt;&lt;/div&gt;
  </code></pre>
  
  <p>I tried both <code>sanitize</code> with <code>SecurityContext.NONE</code> which should work looking at the <a href="https://github.com/angular/angular/blob/master/packages/platform-browser/src/security/dom_sanitization_service.ts#L155" rel="nofollow noreferrer">code</a> and <code>bypassSecurityTrustHtml(value)</code>. The above code was inspired by this <a href="https://stackoverflow.com/a/39858064/857990">answer</a>.</p>
  
  <p>Any ideas on how to execute that JavaScript?</p>