Its good to be careful when the term "sanitize" is being used, because different libraries use it differently - it can mean validation, canonicalization, simple encoding, parsing and encoding.
The AngularJS Sanitize function "sanitizes" inputs by parsing the HTML into tokens. All safe tokens (from a whitelist) are then serialized back to properly encoded values. In this way it behaves similarly to
the OWASP HTML Sanitizer Project and the older OWASP Antisamy project.
https://odetocode.com/blogs/scott/archive/2014/09/10/a-journey-with-trusted-html-in-angularjs.aspx for more information on using the library.
- The parsing and removal of tags is more prone to being bypassed - I don't know of any current issues
- It modifies the HTML to remove unrecognized tags, which can sometimes be fragile
- It has to make assumptions about whether the underlying content is encoded
- The tag support will be limited to the white list - however, you can decorate the $sanitize service to change the list
So where you can:
- Encode at the time the data is being used in the context - for example by using binding.
- Leverage the Sanitize function if you didn't compose it
- Try to leverage CSP (Content Security Policy) as a defense in depth