How to avoid adding prefix "unsafe" to javascript by AngularJs? - angularjs

Question

I try to add bookmarklet button to my website with generating link in a controller.
Template part:
<a id="bookmarklet"
class="bookmarklet"
onclick="alert('Drag and drop me to the bookmarks bar');return false;"
href="{{getCode()}}">
+ Add
</a>
Controller part:
$scope.getCode = function () {
var code = 'javascript:(function(){s=document.createElement(\'SCRIPT\');s.type=\'text/javascript\';' +
's.src=\'http://localhost:9000/scripts/bookmarklet/bookmarklet.js?x=' + ($scope.user.id) + '\';' +
'document.getElementsByTagName(\'head\')[0].appendChild(s);document.sc_srvurl=\'http://localhost:8080\'})();' ;
return code;
};
But I get following after compilation:
<a class="bookmarklet" href="unsafe:javascript:(function(){s=document.createElement('SCRIPT');s.type='text/javascript';s.src='http://localhost:9000/scripts/bookmarklet/bookmarklet.js?x=5517325d40c37bc2bfe20db6';document.getElementsByTagName('head')[0].appendChild(s);document.sc_srvurl='http://localhost:8080'})();">
+ Add
</a>
Link starts with "unsafe" and I can't get how to tell angular to trust this link.
This answer - Angular changes urls to "unsafe:" in extension page suggests to add protocol to whitelist.
I don't want to disable $sce or adding "javascript" to whitelist protocols as I think it's insecure.
May I tell somehow to angularjs to avoid adding prefix "unsafe" by using $sce? Unfortunately documentation is not clear for me and $sce.trustAsJs(code) haven't helped me.
!EDIT Angular version is 1.4.1.

Answer 1

Try to circumvent the restrictions by writing a custom directive:
var app = angular.module('myApp', []);
app.directive('bookmarklet', function () {
return {
restrict: 'A',
scope: {},
link: function($scope, element, attrs) {
if (element[0].tagName !== 'A') {
return; // simply do nothing (or raise an error)
}
element[0].href = 'javascript:alert("It works in 1.4.1, too!")';
}
};
});
Usage:
<div ng-app="myApp">
<a href="#foo" bookmarklet>click me</a>
</div>
I also created a fiddle demo to test it: http://jsfiddle.net/t0acdxcL/1/