3 ms·
But Angular only reads HTML that it's told to read, specified by the "ng-app" attribute/directive.
But Angular only reads HTML that it's told to read, specified by the "ng-app" attribute/directive.
And the webpage can place the ng-app directive into itself.
Yes, but in a browser extension context the web page controls the HTML involved and is the thing you want to defend against. So relying on the HTML to play nice is not OK.
[Disclaimer: I work for Mozilla.]