HTML is rendered in drag clue tooltip (no XSS risk)

[mbechev]

Description

Setting a Grid column title property to an HTML, the code is executed in the tooltip when we drag that column for grouping.

The built-in Angular protection kicks in, and the app is protected from common web application vulnerabilities and attacks. However, the tooltip must include plain text.

Steps To Reproduce

1. Group the third column.
2. The tooltip has H1 inside.

https://stackblitz.com/edit/angular-kwrwtmfw?file=src%2Fapp%2Fapp.component.ts

Actual Behavior

The HTML isn't suppressed inside the tooltip.

Expected Behavior

The tooltip must show only plain text.