javascript - How is concatenating urls in templates in angular less secure than in other locations? -

I have an angular railway template, which looks like this:

  & lt; Img ng: src = "/ resources / {{id}} / thumbnail" />   
 However this is the result in one. Unlike this template:  
  & lt; Img ng: src = "{{fullUrl}}" />   
 Or even:  
  & lt; Img ng: src = "{{id | createThumbnailURL}}" / & gt;   
 (Where createThumbnailURL is a simple filter that processes the same process as above) works perfectly well.  
 The documentation says:  
 
 The conjunction expression makes it difficult to argue that some combination of conceptualized valuation is unsafe to use and can easily be XSS Are there.   
 OK, always a constant url included, I see point there though it is not extraordinary for me that they are REST-APIs that have URLs that are created by simple containment And it should be merged  somehwere  I can do it in the controller or even server side, but  how to insert any other place Finds improvements?  And  What is the suggestion of dealing with this problem?   
  UPDATE   
 There is a demo for this error:  
 It may be that the page is XML .  
 
  This is called SCE (strict referencing escoding):  Like many "hardness" modes, this configuration Eligible but as V 1.2 it is automatically set to true.  
 More specifically refers to angular weak (like URL) in references, where there is permission for short interpolation (hardness). Your URL termination is being "synthesized"  
 You already know about this reason:   XSS attacks   use it to protect the developer Also used: Some incorrect urls can cause data removal or overwriting.  
 Why are you probably confused that the complete string is <0> ng: src = "{{fullUrl}}"  is more secure than string combination  ng: src = "/ Resources / {{id}} / thumbnail ". TBH, I'm not sure there is any serious difference, but these decisions are call.  
  1)  ,  } / <>   
  2)  If you type  
  angular.module ('myApp') If you choose, you can disable SEC on your application. Config (function ($ sceProvider) {$ sceProvider.enabled (false);});   
 
  Correction:   
 You can not call the $ sce service from the instruction. Only $ Scope service is available directly but you can use a function (or a function  
  $ scope.createUrl = function (strName) {var truststrings = '/ resources /' + strName + '/ thumbnail'; return truststring;} < / Code>  
 and your directive  
   & gt;   
 In this case, if you wrap your inclusion in a function, then even after breaking the SEC rule you will not need to deactivate it.