--> in ng-repeat breaks the compilation

[mhevery]

http://jsfiddle.net/XGpq4/

The issue is in ngRepeat:

        $compileNode = templateAttrs.$$element =
            jqLite('<!-- ' + directiveName + ': ' + templateAttrs[directiveName]  + ' -->');
        compileNode = $compileNode[0];

and it should be

        $compileNode = templateAttrs.$$element =
            jqLite(document.createComment(directiveName + ': ' + templateAttrs[directiveName]));

This in theory could allow of script injection.

[petebacondarwin]

Are there other places where similar string concatenation occurs that should be removed?

[mhevery]

Thanks