XSS in Angular Directive

1.page-component

extends index.jade
append head
  base(href='/angular/component/')
  script.
    angular.module('TM_App')      //disable routing
           .config(
              function($stateProvider, $urlRouterProvider, $locationProvider)
                {
                  $urlRouterProvider.deferIntercept();
                });


append body
  show_View

2.show-view.coffee

angular.module('TM_App')
       .directive 'showView', ($compile,$location)->
          return {
            link: ($scope,element)->
              viewName = $location.$$path.substring(1)
              html     = "<#{viewName}/>"
              compiled =  $compile(html);
              content  = compiled($scope)
              element.append(content)
            }

3.exploit.md

http://localhost:12345/angular/component/landing_bar%22%3E%3Cimg%20src=aaa%20onerror=alert(42)%3E

4.show-view-(safe).coffee

angular.module('TM_App')
       .directive 'showComponent', ($compile,$location)->
          return {
            link: ($scope,element)->
              component_Name = $location.$$path.substring(1)
              component      =  document.createElement(component_Name)
              element.append $compile(component)($scope)
            }