ngSanitize can make input placeholder modiafiable in Internet Explorer 11 #15700
Description
Do you want to request a feature or report a bug?
Report a bug.
What is the current behavior?
ngSanitize can make input placeholder modiafiable in Internet Explorer 11 if input element's parent has disabled attribute. User can click input and start modifying placeholder text. Without ngSanitize input is simply disabled in Internet Explorer 11.
If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem via https://plnkr.co or similar (template: http://plnkr.co/edit/tpl:yBpEi4).
<!DOCTYPE html>
<html ng-app="customApp">
<head>
<title>Internet Explorer 11 and input placeholder</title>
</head>
<body disabled>
<input type="text" size="60" placeholder="Placeholder can be modified in Internet Explorer 11">
<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.1/angular.min.js"></script>
<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.1/angular-sanitize.min.js"></script>
<script>
angular.module('customApp', ['ngSanitize']);
</script>
</body>
</html>
What is the expected behavior?
Input with placeholder would behave identically as plain HTML without AngularJS (i.e., input is simply disabled).
Which versions of AngularJS, and which browser / OS are affected by this issue? Did this work in previous versions of AngularJS? Please also test with the latest stable and snapshot (https://code.angularjs.org/snapshot/) versions.
AngularJS: 1.6.1, 1.6.2 and snapshot (build.5274+sha.79c4a71)
Internet Explorer 11 - versions 11.0.9600.18524 and 11.0.9600.18537